CVE-2022-51009
HighCVSS 7.5Summary
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
Risk Assessment
DoS attack may cause game server unavailability, impacting player experience and service continuity.
Recommendation
Upgrade PocketMine-MP to version 4.7.2 or later, which includes the exception handling fix.
Other vulnerabilities in PocketMine-MP
See all- CVE-2022-51008Medium
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
- CVE-2021-48007Medium
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
- CVE-2021-48006Low
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
- CVE-2020-37277Medium
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.
- CVE-2023-7332High
PocketMine-MP versions prior to 4.18.1 have an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request dropping more items than available in the hotbar, causing a server crash and denial of service.
Original NVD description (English source)
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.