CVE-2022-51011: PocketMine-MP DoS Vulnerability

CVE-2022-51011 Overview

CVE-2022-51011 is a denial-of-service vulnerability in PocketMine-MP, a server software for Minecraft: Bedrock Edition. Versions before 4.2.10 fail to validate the total length of incoming chat message blobs before splitting them by newline characters. Attackers can send megabyte-sized chat packets containing thousands of newlines, forcing the server to spend seconds or minutes processing a single message. Repeated malicious packets from a low-privileged authenticated client lock up the server and disrupt gameplay for all connected users. The flaw is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Authenticated attackers can trigger server lockups lasting seconds to minutes by sending oversized chat messages, resulting in denial of service for all connected players.

Affected Products

PocketMine-MP versions prior to 4.2.10
Minecraft: Bedrock Edition server deployments using PocketMine-MP
Any hosted PocketMine-MP instance accepting player chat input

Discovery Timeline

2026-09-07 - CVE-2022-51011 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2022-51011

Vulnerability Analysis

The vulnerability resides in the chat() method within src/player/Player.php. When a player submits a chat message, the server calls explode("\n", $message) to split the message into individual lines before enforcing per-line length and rate limits. The explode() call is invoked without any upper bound on the number of splits or the total input size. A malicious client can send a chat packet containing several megabytes of newline characters, forcing PHP to allocate an array with thousands of entries and consuming significant CPU during string tokenization.

Although the per-line length limit (MAX_CHAT_BYTE_LENGTH) and per-message counter (messageCounter) reject individual overlong lines, they only apply after explode() has already processed the entire buffer. Repeated packets amplify the resource cost, blocking the server's main event loop.

Root Cause

The root cause is missing input validation on the total byte length of the incoming chat blob. The server trusts the client-supplied message size and defers all length checks until after the expensive split operation. This design pattern turns a bounded-per-line check into an unbounded whole-message parse.

Attack Vector

Exploitation requires a valid authenticated session on the target server, which is trivial for any player capable of connecting. The attacker sends chat packets containing many newline characters, then repeats the operation to sustain the denial-of-service condition over the network.

php

 	public function chat(string $message) : bool{
 		$this->removeCurrentWindow();
 
+		//Fast length check, to make sure we don't get hung trying to explode MBs of string ...
+		$maxTotalLength = $this->messageCounter * (self::MAX_CHAT_BYTE_LENGTH + 1);
+		if(strlen($message) > $maxTotalLength){
+			return false;
+		}
+
 		$message = TextFormat::clean($message, false);
-		foreach(explode("\n", $message) as $messagePart){
+		foreach(explode("\n", $message, $this->messageCounter + 1) as $messagePart){
 			if(trim($messagePart) !== "" && strlen($messagePart) <= self::MAX_CHAT_BYTE_LENGTH && mb_strlen($messagePart, 'UTF-8') <= self::MAX_CHAT_CHAR_LENGTH && $this->messageCounter-- > 0){
 				if(strpos($messagePart, './') === 0){
 					$messagePart = substr($messagePart, 1);

Source: PocketMine-MP commit df33e17. The patch adds a fast total-length check computed from messageCounter * (MAX_CHAT_BYTE_LENGTH + 1) and bounds explode() with a maximum split count.

Detection Methods for CVE-2022-51011

Indicators of Compromise

Sudden spikes in CPU usage on the PocketMine-MP server process without corresponding player activity increases.
Player reports of server unresponsiveness, chat lag, or timeouts lasting seconds or minutes.
Inbound chat packets exceeding several kilobytes in size from a single client.
Repeated high-frequency chat packets originating from one authenticated session.

Detection Strategies

Instrument the server with timing metrics around the Player::chat() method to detect calls that exceed normal processing thresholds.
Monitor packet size distributions for chat messages and alert on outliers above expected human-typed lengths.
Correlate main-loop tick delays with recent inbound packet metadata to attribute lockups to specific clients.

Monitoring Recommendations

Enable verbose logging for chat handling and record message length, newline counts, and originating player identifiers.
Track per-player packet rates and byte volumes to identify clients exceeding realistic gameplay baselines.
Aggregate server tick duration metrics into a monitoring pipeline to surface sustained processing stalls.

How to Mitigate CVE-2022-51011

Immediate Actions Required

Upgrade PocketMine-MP to version 4.2.10 or later, which contains the fix for [CWE-20] improper input validation on chat messages.
Restrict server access to trusted players using allowlists or authentication plugins until the upgrade is applied.
Kick and temporarily ban any client observed sending oversized chat packets.

Patch Information

The fix is committed in PocketMine-MP commit df33e17 and shipped in the 4.2.10 release. Details are documented in the PocketMine-MP GHSA-gj94-v4p9-w672 advisory and the VulnCheck denial-of-service advisory. Server operators should redeploy from a known-good build and verify the patched Player.php includes the total-length pre-check.

Workarounds

Deploy a network-layer rate limit on chat packet frequency and total byte volume per session.
Apply an inline plugin or proxy that rejects chat messages exceeding a small fixed byte threshold, such as a few kilobytes.
Disable the in-game chat feature entirely on public servers that cannot be upgraded immediately.

bash

# Verify PocketMine-MP version and upgrade path
php PocketMine-MP.phar --version

# Recommended: upgrade to 4.2.10 or newer
git fetch --tags
git checkout 4.2.10
composer install --no-dev --optimize-autoloader