CVE-2022-51011: PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious client with low-privilege access to the PocketMine-MP server can exploit it remotely. No user interaction is required.
What conditions are needed to trigger the denial of service?
The attacker must be able to send chat packets to the server. Exploitation uses very large chat-message blobs containing many newline characters, potentially sent repeatedly.
Which deployments are affected?
PocketMine-MP versions before 4.2.10 are affected. The provided information does not identify any configuration prerequisite, so servers that accept client chat traffic should be considered exposed.
What is the practical impact?
Repeated malicious chat packets can cause server lockups lasting seconds or minutes. The reported impact is availability only; no confidentiality or integrity impact is stated.
How can I reduce exposure if upgrading is not immediately possible?
The provided data does not specify a workaround. Restricting access by untrusted clients where operationally feasible may reduce the opportunity to send the malicious chat packets, but updating to 4.2.10 or later is the documented version boundary for the issue.