CVE-2022-51018 in PocketMine-MP
Summary
by MITRE • 09/07/2026
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in PocketMine-MP versions prior to 3.26.5 and 4.0.x before 4.0.5 represents a critical input validation failure within the game server's handling of player-generated content, specifically writable books. This flaw allows malicious actors with access to create items that exceed internal size constraints, leading to severe operational disruptions including bandwidth exhaustion and complete service unavailability through denial-of-service conditions. The core technical deficiency lies in the absence of strict boundary checks on three specific attributes of book items: the length of text per page, the total number of pages allowed within a single item stack, and the character limits applied to author names or titles. In standard Minecraft protocol implementations, these fields are subject to rigid constraints designed to prevent abuse; however, PocketMine-MP failed to enforce these limits during the parsing and storage phases of NBT data associated with book items.
From an architectural perspective, this vulnerability exploits how the server processes Network Byte Order (NBT) structures when a player interacts with a writable book interface. When a user inputs text into the book creation GUI, the client sends this data to the server for validation before finalizing the item stack. In vulnerable versions of PocketMine-MP, the server accepts arbitrarily large strings and excessive page counts without truncation or rejection. This lack of sanitization means that a single player can construct an item with thousands of pages containing megabytes of text, effectively creating what is colloquially referred to as a book bomb. The severity of this issue varies slightly between major version branches due to differences in internal data handling mechanisms, but both result in catastrophic failure states for the server instance.
In PocketMine-MP 3.x versions, the impact manifests primarily through memory and storage exhaustion related to region-based world saving protocols. These older iterations rely on a chunking system where terrain data is saved into individual files known as regions. Each of these region files has a hard limit of approximately one megabyte for its NBT payload. When an oversized book item exists within the game world, particularly if it is dropped or stored in a chest that gets loaded and subsequently unloaded during normal gameplay cycles, the server attempts to serialize this excessive data into the chunk file. Because the input exceeds the one-megabyte threshold, the serialization process fails catastrophically, often resulting in corrupted save files or immediate termination of the server thread handling that specific world tick cycle. This leads to persistent instability and potential loss of game state if not manually recovered from backups.
Conversely, in PocketMine-MP 4.x versions, the vulnerability triggers a different failure mode rooted in protocol-level constraints. The newer engine enforces stricter limits on individual NBT tag sizes, specifically capping TAG_String values at thirty-two kilobytes. When a player attempts to create or hold a book that exceeds this limit due to unchecked page counts and text lengths, the server encounters an invalid packet structure during network transmission or internal processing. This violation causes the connection handling thread to crash or disconnect abruptly. Since these operations often occur on critical paths such as inventory management or item transfer events, even minor interactions with maliciously crafted items can destabilize the entire server environment, causing widespread disconnections for legitimate players and rendering the service unusable until a restart is performed.
The operational impact of this vulnerability extends beyond simple downtime. The excessive bandwidth consumption generated by transmitting oversized NBT data packets to clients or other servers in multiplayer setups can saturate network links, affecting latency and packet delivery for all connected users. Furthermore, repeated attempts to process these malformed items place significant CPU overhead on the server as it struggles with memory allocation failures and exception handling loops. For hosting providers running multiple instances, this vulnerability poses a risk of cross-instance resource contention if shared resources are not properly isolated, potentially leading to cascading failures across hosted environments.
From a classification standpoint, this issue aligns closely with CWE-20 Improper Input Validation, as the server fails to verify that user-supplied data conforms to expected structural and size constraints before processing it. Additionally, it maps to ATT&CK technique T1498 Network Denial of Service, specifically sub-technique 1498.003 Resource Exhaustion via Flooding or Overwhelming Volume, where the attacker utilizes oversized payloads to exhaust server resources such as memory, bandwidth, or processing capacity. The vulnerability also touches upon CWE-787 Out-of-bounds Write if one considers how internal buffers might be overrun during serialization attempts in certain edge cases within the 3.x codebase, although denial of service via resource exhaustion is the primary observable effect.
Mitigation strategies must prioritize immediate software updates and defensive configuration adjustments. The most effective remediation is upgrading PocketMine-MP to version 3.26.5 or later for legacy servers, or version 4.0.5 and above for modern deployments, as these releases include patches that enforce strict length limits on book pages, page counts, and metadata fields like author names. For administrators unable to update immediately due to plugin compatibility concerns, implementing server-side plugins that intercept item creation events can provide a temporary workaround by validating NBT data before it is committed to the game world. These plugins should reject any writable books exceeding standard Minecraft limits, such as sixty-four pages or specific character counts per page, thereby neutralizing the attack vector at the application layer until an official patch can be applied. Regular auditing of server logs for unusual packet sizes and monitoring bandwidth usage patterns can also aid in early detection of exploitation attempts.