CVE-2022-51017 — PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String…
Published: 2026-09-07 · CVSS: 8.7 · CVSS 4.0
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7