CVE-2022-51009: PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending login or skin packets containing invalid skin geometry JSON. No user interaction or special privileges are required.
What is the operational impact of a successful exploit?
Malformed geometry JSON can trigger an unhandled RuntimeException while the server parses skin geometry data, causing the PocketMine-MP server to crash. The reported impact is denial of service; no confidentiality or integrity impact is indicated.
Which versions need remediation?
PocketMine-MP versions before 4.7.2 are affected. Updating to 4.7.2 or later addresses the affected version range.