pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory
Impact A client can send reliable-ordered packets 0, 2, 3, 4, 5 … etc, and all the packets 2 and up will stay in the reliable-ordered queue until 1 arrives. A malicious client can exploit this to waste all available server memory by simply never sending the missing packet. Since the server does not make any effort to limit the size of the queue or detect this kind of abuse, …