CVE-2022-51009: PocketMine-MP DOS Vulnerability

CVE-2022-51009 Overview

CVE-2022-51009 is a denial-of-service vulnerability in PocketMine-MP, a server software implementation for Minecraft: Bedrock Edition. Versions before 4.7.2 fail to properly handle exceptions thrown by the adhocore/json-comment library when parsing skin geometry data submitted by clients. An unauthenticated remote attacker can send a login or skin packet containing malformed geometry JSON, triggering an unhandled RuntimeException that crashes the server process. The flaw is classified under CWE-248: Uncaught Exception.

Critical Impact
Any unauthenticated network attacker able to connect to the PocketMine-MP server can crash the process with a single malformed skin packet, disrupting availability for all connected players.

Affected Products

PocketMine-MP versions prior to 4.7.2
Minecraft: Bedrock Edition server deployments running vulnerable PocketMine-MP builds
Any PHP application embedding the affected skin geometry parsing path

Discovery Timeline

2026-09-06 - CVE-2022-51009 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2022-51009

Vulnerability Analysis

PocketMine-MP accepts skin data as part of the client login handshake and subsequent skin change requests. The skin payload includes a SkinGeometryData field containing JSON that describes the 3D model. PocketMine-MP delegates parsing of this JSON to the adhocore/json-comment library, which supports JSON with embedded comments.

When the input JSON is malformed, the library raises a RuntimeException rather than returning a null value or a structured error result. The affected version of src/entity/Skin.php does not wrap the decoder call in a try/catch block, so the exception propagates up the packet handling stack. Because the exception occurs in the network I/O thread, it terminates the server process instead of failing gracefully for the offending session.

Root Cause

The root cause is an uncaught exception in the skin geometry parsing routine. The original implementation relied on json_last_error_msg() semantics that do not apply to the exception-based adhocore/json-comment decoder. Any input rejected by the decoder therefore bypasses PocketMine-MP's packet-level error containment.

Attack Vector

Exploitation requires only network reachability to the PocketMine-MP UDP listener. No authentication, prior credentials, or user interaction are needed. An attacker crafts a login packet or a skin update packet with a SkinGeometryData field containing syntactically invalid JSON, then sends it to the target server. The server invokes the vulnerable parser, the RuntimeException propagates, and the PocketMine-MP process crashes. Repeated packets can prevent the server from staying online, producing a persistent denial-of-service condition against all players on the instance.

php

// Patch excerpt from src/entity/Skin.php
 use function implode;
 use function in_array;
 use function json_encode;
-use function json_last_error_msg;
 use function strlen;
 use const JSON_THROW_ON_ERROR;

Source: PocketMine-MP commit c9626c6

The fix removes reliance on json_last_error_msg() and correctly handles exceptions produced by the commented JSON decoder, ensuring that invalid geometry input is rejected at the packet layer without terminating the server.

Detection Methods for CVE-2022-51009

Indicators of Compromise

Unexpected termination of the PocketMine-MP PHP process with a stack trace referencing adhocore/json-comment or Skin::__construct.
Server log entries showing RuntimeException originating from JSON decoding immediately before a crash.
Repeated short-lived client connections from a single source address that end just before the server process exits.

Detection Strategies

Monitor PocketMine-MP crash logs for uncaught RuntimeException events tied to skin packet handling.
Inspect inbound LoginPacket and PlayerSkinPacket traffic for SkinGeometryData payloads that are not valid JSON.
Correlate abrupt process restarts with the source IP address of the last handled packet to identify likely attackers.

Monitoring Recommendations

Enable PHP error logging with full stack traces so unhandled exceptions are captured before process exit.
Ship PocketMine-MP logs to a centralized logging or SIEM platform and alert on repeated fatal errors within a short interval.
Track server uptime metrics and alert on abnormal restart frequency indicative of a DoS attempt.

How to Mitigate CVE-2022-51009

Immediate Actions Required

Upgrade PocketMine-MP to version 4.7.2 or later, which contains the fix in commit c9626c6.
Restrict inbound access to the PocketMine-MP UDP port to trusted networks or authenticated players where feasible.
Deploy a process supervisor such as systemd or supervisord to restart the server automatically after a crash while investigation is ongoing.

Patch Information

The issue is resolved in PocketMine-MP 4.7.2. The upstream fix is available in the security advisory GHSA-8cwq-4cmf-px73 and in the remediation commit c9626c6. Additional context is provided in the VulnCheck advisory.

Workarounds

If patching is not immediately possible, apply a reverse proxy or firewall rule that filters oversized or malformed Bedrock login packets.
Rate-limit new connections per source IP to slow crash-loop attempts against exposed servers.
Temporarily disable public accessibility of the server and require an allowlist of known player IP addresses until the upgrade is deployed.

bash

# Upgrade PocketMine-MP to a fixed release
composer require pocketmine/pocketmine-mp:^4.7.2

# Verify the installed version
php PocketMine-MP.phar --version