CVE-2022-51008: PocketMine-MP Denial of Service Vulnerability

CVE-2022-51008 Overview

CVE-2022-51008 is a denial-of-service vulnerability in PocketMine-MP, a server software for Minecraft: Bedrock Edition. Versions before 4.12.3 fail to limit unauthenticated sessions on the server. Attackers can open connections without sending a LoginPacket, causing those pending sessions to occupy the server's maximum player slots. Legitimate players are then unable to join the server. The flaw is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling]. The vulnerability requires no authentication and is exploitable over the network.

Critical Impact
Remote unauthenticated attackers can exhaust player slots on affected PocketMine-MP servers, preventing legitimate players from connecting and rendering the service unavailable.

Affected Products

PocketMine-MP versions prior to 4.12.3
Minecraft: Bedrock Edition server deployments using PocketMine-MP
Community-hosted PocketMine-MP servers exposed to the public internet

Discovery Timeline

2026-09-06 - CVE-2022-51008 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-51008

Vulnerability Analysis

PocketMine-MP tracks concurrent player connections against a configured maximum slot count. Before version 4.12.3, every accepted network session counted toward the total player limit as soon as it was created, regardless of whether the client had authenticated. An attacker can open network sessions to the server and simply never send the LoginPacket required to complete the handshake. These pending sessions remain resident and continue to occupy slots, so the server rejects new connections from legitimate players. The result is a resource-exhaustion condition affecting service availability while confidentiality and integrity remain unaffected.

Root Cause

The root cause is missing separation between fully authenticated player sessions and pending, unauthenticated sessions inside NetworkSessionManager. The manager exposed a single session count used both for slot enforcement and for administrative reporting. Because unauthenticated connections were counted the same as logged-in players, an attacker could deplete the slot budget without ever proving identity. This behavior maps to CWE-770.

Attack Vector

Exploitation requires only network reachability to the PocketMine-MP listener. An attacker repeatedly opens sessions to the server and withholds the LoginPacket. Each half-open session consumes a slot until the configured player maximum is reached, after which legitimate clients receive server-full responses. No credentials, user interaction, or elevated privileges are needed.

php

// Patch: src/network/NetworkSessionManager.php
/** @var NetworkSession[] */
private array $sessions = [];

/** @var NetworkSession[] */
private array $pendingLoginSessions = [];

/**
 * Adds a network session to the manager. This should only be called on session creation.
 */
public function add(NetworkSession $session) : void{
    $idx = spl_object_id($session);
    $this->sessions[$idx] = $session;
    $this->pendingLoginSessions[$idx] = $session;
}

/**
 * Marks the session as having sent a login request. After this point, they are counted towards
 * the total player count.
 */
public function markLoginReceived(NetworkSession $session) : void{
    $idx = spl_object_id($session);
    unset($this->pendingLoginSessions[$idx]);
}

Source: PocketMine-MP commit 59be901

The patch introduces a pendingLoginSessions collection and a new getValidSessionCount() accessor. Only sessions that have actually sent a LoginPacket are counted toward the player slot limit, closing the resource-exhaustion gap.

Detection Methods for CVE-2022-51008

Indicators of Compromise

Sudden inability of legitimate players to connect while the server reports itself as full.
Large numbers of open TCP or RakNet sessions from a small set of source IP addresses without any subsequent LoginPacket traffic.
Server logs showing sessions created and then timing out without progressing past the handshake stage.
Elevated inbound connection rates on the PocketMine-MP listener port from unfamiliar ranges.

Detection Strategies

Correlate PocketMine-MP session-create events against successful login events; a persistent gap indicates unauthenticated session flooding.
Monitor the ratio of getSessionCount() versus getValidConnectionCount() (available after patching) to identify abnormal pending-session volumes.
Alert when a single source address opens more than a small threshold of concurrent sessions to the game port.

Monitoring Recommendations

Ingest PocketMine-MP server logs and network flow data into a centralized analytics platform for baseline and anomaly comparison.
Track connection lifetime histograms; a spike in very short or stalled sessions is a strong signal of this abuse pattern.
Configure availability probes that attempt a full login handshake and alert when the server begins rejecting legitimate joins.

How to Mitigate CVE-2022-51008

Immediate Actions Required

Upgrade PocketMine-MP to version 4.12.3 or later on all server instances.
Inventory public-facing PocketMine-MP deployments and prioritize patching servers exposed to the internet.
Review server operator dashboards for signs of ongoing slot exhaustion and restart affected instances after patching.

Patch Information

The fix is delivered in PocketMine-MP 4.12.3. It is implemented in commit 59be901 and documented in GitHub Security Advisory GHSA-474q-9hgp-hcvx. Additional analysis is available in the VulnCheck Denial of Service Advisory. The patch separates pending login sessions from active player sessions so that only authenticated clients count toward the slot limit.

Workarounds

Place the server behind a reverse proxy or firewall that enforces per-source connection rate limits on the game listener port.
Restrict inbound access to trusted IP ranges where operationally feasible until the patch is applied.
Reduce session idle timeouts so half-open, unauthenticated sessions are reaped faster.
Monitor and manually terminate stalled sessions that fail to complete the login handshake.

bash

# Example: rate-limit new inbound connections to the PocketMine-MP port (default 19132/udp)
# using iptables to slow unauthenticated session floods from a single source.
iptables -A INPUT -p udp --dport 19132 -m state --state NEW \
    -m recent --set --name pmmp
iptables -A INPUT -p udp --dport 19132 -m state --state NEW \
    -m recent --update --seconds 10 --hitcount 20 --name pmmp -j DROP