CVE-2022-51017 in PocketMine-MP
Summary
by MITRE • 09/07/2026
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in PocketMine-MP versions prior to 3.26.5 and 4.0.5 represents a critical input validation failure within the game server's network protocol handling logic. Specifically, the software fails to enforce strict length constraints on skin data fields submitted by connected players during the authentication or player initialization phases. In standard Minecraft-like protocols, certain binary tags such as TAG_String are subject to size limitations defined by the NBT (Named Binary Tag) specification and internal buffer management routines. The specific limit referenced is 32767 bytes, which corresponds to the maximum value for a signed short integer often used to denote string length in these data structures. By neglecting to validate that incoming skin identifiers or geometry names do not exceed this threshold, the server allows attackers to inject payloads with uncapped lengths directly into the serialization pipeline.
From a technical perspective, this flaw leads to an exception during NBT data serialization when the oversized data is processed. The internal parser attempts to allocate memory or process a string length value that exceeds the expected integer bounds, resulting in a runtime error such as an out-of-bounds access or an arithmetic overflow depending on the specific implementation details of the PHP engine and the PocketMine-MP core. This exception is not gracefully handled by the server's error recovery mechanisms, leading to an immediate termination of the main thread or the worker process responsible for that player connection. Consequently, this results in a Denial of Service condition where the entire game server crashes, requiring manual intervention to restart the service and restore availability for other players.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without authentication requirements in many default configurations or during early connection stages. An attacker can craft a malicious packet containing skin data fields with lengths significantly larger than 32767 bytes, such as excessively long strings in the skinID or geometryName parameters. Upon receiving these packets, the server processes them until the serialization step triggers the fatal exception. This allows for reliable remote code execution avoidance but guarantees service disruption. For multiplayer servers relying on high availability and continuous uptime, this vulnerability poses a significant risk to operational continuity, as repeated attacks can keep the server in a crash-restart loop or cause prolonged downtime during incident response efforts.
This issue aligns with CWE-20 Improper Input Validation, specifically regarding insufficient boundary checks on data fields before processing. It also maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, as the primary effect is the disruption of service availability rather than unauthorized access or privilege escalation. Mitigation strategies primarily involve upgrading to patched versions of PocketMine-MP where this validation logic has been corrected to enforce strict length limits on all incoming skin-related data fields. Additionally, server administrators should implement network-level filtering rules if possible, such as limiting packet sizes at the firewall level, and ensure that error handling routines are robust enough to prevent single-point failures from cascading into full system crashes while awaiting patch deployment.