CVE-2022-51014: PocketMine-MP Denial of Service Vulnerability

CVE-2022-51014 Overview

CVE-2022-51014 is a denial-of-service vulnerability affecting PocketMine-MP versions before 4.0.7. PocketMine-MP is a server software implementation for Minecraft: Bedrock Edition. The flaw resides in the ModalFormResponsePacket handler, which fails to catch exceptions raised when parsing malformed JSON supplied by clients. An authenticated attacker on the network can send a crafted form response packet containing invalid JSON to trigger an unhandled InvalidArgumentException, crashing the server process. The issue is classified under [CWE-248] (Uncaught Exception).

Critical Impact
Any low-privileged connected player can crash a PocketMine-MP server by sending a single malformed form response packet, resulting in complete service disruption.

Affected Products

PocketMine-MP versions prior to 4.0.7
Minecraft: Bedrock Edition server deployments running vulnerable PocketMine-MP builds
Community servers using unpatched PocketMine-MP forks incorporating the vulnerable InGamePacketHandler

Discovery Timeline

2026-09-07 - CVE-2022-51014 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2022-51014

Vulnerability Analysis

The vulnerability exists in the JSON repair path used by PocketMine-MP when processing ModalFormResponsePacket messages. Clients submit form responses containing JSON payloads. The server attempts to normalize non-standard client JSON via a repair routine before decoding. When decoding still fails, the code throws a raw \InvalidArgumentException. This exception type is not caught by the packet processing pipeline, which only handles PacketHandlingException for recoverable protocol errors. The uncaught exception propagates up the main event loop and terminates the server process. Because form responses can be sent by any authenticated player during normal gameplay, exploitation requires only standard client-level access to the server.

Root Cause

The root cause is the use of an inappropriate exception type inside the JSON repair helper in src/network/mcpe/handler/InGamePacketHandler.php. Raising \InvalidArgumentException signals a programmer error rather than a network protocol error. The packet dispatch layer treats protocol errors as recoverable by catching PacketHandlingException, but leaves generic exceptions to bubble up and crash the server.

Attack Vector

An authenticated player connects to a PocketMine-MP server and sends a ModalFormResponsePacket whose payload contains JSON that cannot be repaired by the server-side normalization logic. The server invokes json_decode, fails, and throws the uncaught exception. No memory corruption, code execution, or data disclosure occurs; the impact is limited to availability. The attack requires network reachability to the server port and a valid game session.

php

// Patch excerpt from src/network/mcpe/handler/InGamePacketHandler.php
$fixed = "[" . implode(",", $newParts) . "]";
if(($ret = json_decode($fixed, $assoc)) === null){
-    throw new \InvalidArgumentException("Failed to fix JSON: " . json_last_error_msg() . "(original: $json, modified: $fixed)");
+    throw new PacketHandlingException("Failed to fix JSON: " . json_last_error_msg() . "(original: $json, modified: $fixed)");
}

return $ret;

Source: PocketMine-MP commit 56fe71d. The fix converts the raw \InvalidArgumentException into a PacketHandlingException, which the packet dispatcher catches and handles as a recoverable protocol error, disconnecting the offending client instead of crashing the server.

Detection Methods for CVE-2022-51014

Indicators of Compromise

Abrupt PocketMine-MP process termination with stack traces referencing InGamePacketHandler and InvalidArgumentException
Log entries containing the string Failed to fix JSON followed by server shutdown
Repeated short-lived sessions from a single player account immediately before server crashes

Detection Strategies

Monitor PocketMine-MP crash logs and PHP fatal error output for uncaught InvalidArgumentException originating from the packet handler namespace.
Correlate ModalFormResponsePacket handling errors with the source IP and Xbox Live identifier of the last active session.
Alert on repeated unexpected server restarts within short windows, which typically indicate DoS attempts against the packet parser.

Monitoring Recommendations

Enable verbose network packet logging on non-production instances to capture malformed form response payloads for analysis.
Forward PocketMine-MP crash dumps and PHP error logs to a centralized log store for retention and correlation.
Track process uptime metrics and generate alerts when the server restarts more frequently than an established baseline.

How to Mitigate CVE-2022-51014

Immediate Actions Required

Upgrade PocketMine-MP to version 4.0.7 or later, which contains the fix from commit 56fe71d.
Audit any custom forks or plugins that override InGamePacketHandler to confirm they use PacketHandlingException for recoverable protocol errors.
Restrict server access to trusted player allowlists where feasible until patching is complete.

Patch Information

The fix is available in PocketMine-MP 4.0.7. See the GitHub Security Advisory GHSA-wjfq-88q2-r34j and the VulnCheck Denial of Service Advisory for full details. The patch commit is documented at PocketMine-MP commit 56fe71d.

Workarounds

Run PocketMine-MP under a process supervisor such as systemd or supervisord to automatically restart the server after a crash, limiting downtime while patching is scheduled.
Apply the upstream patch manually by editing src/network/mcpe/handler/InGamePacketHandler.php to throw PacketHandlingException instead of \InvalidArgumentException in the JSON repair block.
Use a whitelist to limit connections to known player accounts, reducing exposure to anonymous abusers.

bash

# Example systemd restart configuration for PocketMine-MP
[Service]
ExecStart=/usr/bin/php /opt/pocketmine/PocketMine-MP.phar
Restart=on-failure
RestartSec=5s