CVE-2022-51009 in PocketMine-MP
Summary
by MITRE • 09/06/2026
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in PocketMine-MP versions prior to 4.7.2 represents a critical stability issue rooted in improper exception handling during the processing of player-specific data structures. Specifically, the flaw resides within the module responsible for parsing skin geometry information, which relies on the adhocore/json-comment library to interpret JSON-formatted geometric definitions used by Minecraft clients to render character models. When a client connects or updates its appearance, it transmits packets containing this geometry data. The server software attempts to parse these payloads using the aforementioned external library. However, the implementation lacks robust error handling mechanisms for cases where the input does not conform to expected valid JSON syntax or contains malformed structures that trigger internal errors within the parsing logic.
This technical deficiency allows an unhandled RuntimeException to propagate up through the call stack without being caught by a local try-catch block. In software engineering terms, this is a classic example of insufficient exception handling where critical failures are not intercepted and managed gracefully. Instead of logging the error and disconnecting the offending client or returning a default safe state, the application allows the fatal error to terminate the main execution loop. This results in an immediate crash of the PocketMine-MP server process. The vulnerability is particularly severe because it can be triggered remotely by any player attempting to join the server or update their skin, requiring no prior authentication privileges beyond basic network connectivity to the game port.
From a security operations perspective, this flaw directly impacts the availability component of the CIA triad. An attacker with minimal effort can send crafted login packets or skin update packets containing invalid geometry JSON strings to induce a denial-of-service condition against the entire server infrastructure. This is not merely an inconvenience but a significant operational risk for game administrators who rely on continuous uptime for their communities. The attack vector aligns with CWE-754, which describes improper check for unusual or exceptional conditions, and specifically relates to CWE-248, unhandled exception, where the failure to handle exceptions leads to system instability. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates a Denial-of-Service attack via resource exhaustion or service disruption, categorized under techniques that target application availability rather than confidentiality or integrity.
Mitigation strategies for this issue primarily involve upgrading the PocketMine-MP software to version 4.7.2 or later, where developers have implemented proper exception handling routines around the JSON parsing operations. Until an upgrade is feasible, administrators should consider implementing network-level filtering rules if possible, though such controls are often difficult due to the encrypted nature of Minecraft protocol traffic and the dynamic port usage common in gaming environments. Additionally, deploying a reverse proxy or application firewall that can inspect packet payloads for obvious syntax violations before they reach the game server may provide an additional layer of defense against malformed inputs. It is also advisable to monitor server logs for repeated connection attempts from single IP addresses followed by sudden service interruptions, which could indicate active exploitation attempts targeting this specific flaw.