CVE-2022-51012: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 4.2.9
Event History
Frequently Asked Questions
Which deployments are exposed?
PocketMine-MP deployments running versions earlier than 4.2.9 are affected. The vulnerable packet handling is reachable from clients over the network.
What does an attacker need to exploit this issue?
An attacker needs client-level access sufficient to send inventory transaction packets to the server. They can submit a crafted transaction containing malformed NBT tags; no user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can crash the PocketMine-MP server, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.
What should be done if the server cannot be patched immediately?
The provided information identifies upgrading to version 4.2.9 or later as the version boundary for the issue, but does not specify an alternative mitigation. Until upgraded, limit access by untrusted clients where operationally possible.