Skip to content

Endlink v0.1.1

Choose a tag to compare

View all tags
@luibara2 luibara2 released this 12 Aug 18:08
· 7 commits to main since this release
v0.1.1
4340af9

Security fix release — updating from v0.1.0 is recommended.

Security

  • Fixed a pre-auth denial-of-service (zlib decompression bomb). The zlib decompression
    size cap was not being enforced, so an unauthenticated client could send a small compressed
    batch that inflated without bound and exhausted the proxy's memory before logging in. The
    cap (bedrock.maxDecompressedBytes, default 10 MB) is now enforced on the zlib path, matching
    the Snappy path, and is covered by a regression test. Reported through responsible disclosure.

Other changes since v0.1.0

  • ViaEndlink (the Java Edition addon) is now linked from the sibling projects, marked beta.
  • Fuller packet diagnostics: resource-pack response status and item-stack requests/responses
    are now traceable.

Endlink.jar is a drop-in replacement for v0.1.0.

Assets 3
Loading