CVE-2025-71418: PocketMine-MP before 5.25.2 Denial of Service via explode
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.25.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
PocketMine-MP deployments running versions before 5.25.2 are affected. The issue is reachable through packet parsing paths including sign editing, JWT parsing, and command parsing.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access with low attack complexity, no privileges, and no user interaction required; a malicious client can send crafted packets.
What is the practical impact of a successful attack?
Crafted packets containing excessive delimiters can cause unbounded explode() processing, consuming CPU and memory resources. The stated impact is denial of service through resource exhaustion.