{"id":"CVE-2020-37277","title":"PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method","summary":"PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple confli…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"pmmp","product":"PocketMine-MP","affected":["PocketMine-MP < 3.15.4"],"published":"2026-09-06","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:05:53.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-37277","references":[{"url":"https://github.com/pmmp/PocketMine-MP/commit/c368ebb5e74632bc622534b37cd1447b97281e20","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-3.15.4-denial-of-service-via-inventorytransaction","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00295,"epssPercentile":0.22372,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T13:27:34.190182Z"},"ingestedAt":"2026-09-07T00:02:13.800Z","slug":"CVE-2020-37277","body":"## Overview\n\nPocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}