CVE-2022-51008: PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PocketMine-MP deployments running a version before 4.12.3 are affected. An attacker can reach the issue remotely over the network without authentication or user interaction.
What does an attacker need to do to disrupt the server?
The attacker needs to create unauthenticated sessions and avoid sending a LoginPacket. Repeated connections can consume the server's maximum player slots and prevent legitimate players from joining.
How can I tell whether the server is being affected?
A likely indicator is that player slots are exhausted while the occupying connections have not completed login by sending a LoginPacket. Legitimate players may be unable to join because the max-player limit has been reached.