CVE-2022-51017: PocketMine-MP DOS Vulnerability

CVE-2022-51017 Overview

CVE-2022-51017 is a denial-of-service vulnerability in PocketMine-MP, an open-source Minecraft: Bedrock Edition server implementation written in PHP. Versions prior to 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by connecting players. Attackers can send oversized skinID or geometryName fields that exceed the 32,767 byte TAG_String limit used by the NBT (Named Binary Tag) serialization format. When the server attempts to serialize the malicious skin data, it throws an exception and crashes. The flaw is categorized as improper input validation [CWE-20] and can be triggered by any unauthenticated remote player.

Critical Impact
Unauthenticated remote attackers can crash PocketMine-MP servers by submitting oversized skin data fields during connection, resulting in denial of service for all connected players.

Affected Products

PocketMine-MP versions prior to 3.26.5
PocketMine-MP versions prior to 4.0.5
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds

Discovery Timeline

2026-09-07 - CVE-2022-51017 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-51017

Vulnerability Analysis

The vulnerability resides in the Skin class within src/entity/Skin.php (4.x branch) and src/pocketmine/entity/Skin.php (3.x branch). PocketMine-MP accepts skin metadata from clients during the login and skin change flow. Fields such as skinID and geometryName are stored as strings and later serialized using NBT encoding. NBT strings use a 16-bit unsigned length prefix, capping any single string at 32,767 bytes.

Because the server accepts these fields without enforcing a maximum length, a crafted client can send strings that exceed the NBT bound. When the entity or player data is next serialized, the TAG_String writer throws an exception. The exception propagates up the packet handler and terminates the server process, disconnecting all active players. The VulnCheck Advisory for PocketMine-MP documents the crash path and impact.

Root Cause

The root cause is missing input length validation on player-supplied skin metadata before that data enters the NBT serialization pipeline. The Skin constructor did not enforce upper bounds on string fields, deferring failure to a downstream serializer that cannot represent strings larger than INT16_MAX bytes.

Attack Vector

The attack requires no authentication and no user interaction. An attacker connects to a vulnerable PocketMine-MP server as a normal Minecraft client and transmits a login packet whose skin payload contains an oversized skinID or geometryName. The subsequent serialization attempt raises an exception, crashing the server.

php

// Patch excerpt: src/entity/Skin.php (4.x branch)
 namespace pocketmine\entity;

 use Ahc\Json\Comment as CommentedJsonDecoder;
+use pocketmine\utils\Limits;
 use function implode;
 use function in_array;
 use function json_encode;

// Source: https://github.com/pmmp/PocketMine-MP/commit/6492cac5c10f9fa8443ceddd2191a7b65b73f601

php

// Patch excerpt: src/pocketmine/entity/Skin.php (3.x branch)
 use function in_array;
 use function json_encode;
 use function strlen;
+use const INT32_MAX;

 class Skin{
 	public const ACCEPTED_SKIN_SIZES = [

// Source: https://github.com/pmmp/PocketMine-MP/commit/958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb

Both commits introduce explicit length constants and add validation logic in the Skin constructor that rejects fields exceeding the NBT TAG_String bound before serialization occurs.

Detection Methods for CVE-2022-51017

Indicators of Compromise

Unexpected PocketMine-MP process termination coinciding with a new player connection or skin change event.
Server logs showing exceptions from the NBT serialization layer referencing TAG_String length overflow.
Repeated connection attempts from the same IP followed immediately by server crashes.
Login packets containing skin metadata fields larger than 32,767 bytes.

Detection Strategies

Enable verbose logging of the login and skin change handlers to capture skin field sizes prior to serialization.
Monitor PocketMine-MP crash dumps and stack traces for exceptions originating in NBT TAG_String write paths.
Correlate abnormal service restarts of the Minecraft server process with recent inbound connections.

Monitoring Recommendations

Alert on PocketMine-MP process restarts that occur within seconds of a new session establishment.
Track connection sources against a baseline; investigate unfamiliar IPs that precede crashes.
Instrument the host with runtime workload telemetry to capture process termination events and forward them to a centralized SIEM for correlation.

How to Mitigate CVE-2022-51017

Immediate Actions Required

Upgrade PocketMine-MP to version 3.26.5 or 4.0.5 or later without delay.
Restrict network exposure of the game server to trusted players using firewall allow-lists while patching is in progress.
Review recent server crashes and connection logs for evidence of prior exploitation attempts.

Patch Information

The upstream fix is delivered by commits 6492cac5 and 958a9dbf, corresponding to the 4.x and 3.x branches. Full details are published in GitHub Security Advisory GHSA-c6fg-99pr-25m9. Operators should install the fixed releases and restart the server process.

Workarounds

Place the PocketMine-MP server behind a reverse proxy or firewall that limits inbound traffic to authenticated or known player IP addresses.
Deploy a supervisor such as systemd with automatic restart on failure to reduce downtime while a patch is being applied.
Monitor the whitelist and disconnect any player accounts observed triggering serialization exceptions.

bash

# Update PocketMine-MP to a fixed release
# 4.x branch
composer require pocketmine/pocketmine-mp:^4.0.5

# 3.x branch
composer require pocketmine/pocketmine-mp:^3.26.5

# Restart the server process
systemctl restart pocketmine-mp