CVE-2022-51018 Overview
CVE-2022-51018 is a denial-of-service vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. The server fails to enforce limits on book page text length, page count, and author/title length. An authenticated player who obtains a writable book can craft oversized Named Binary Tag (NBT) payloads, known as book bombs. These payloads consume excessive bandwidth and crash the server. In PocketMine-MP 3.x, the crash results from exceeding the 1 MB chunk size limit when saving region-based worlds. In PocketMine-MP 4.x, the failure occurs when the payload exceeds the 32 KiB TAG_String limit. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
A low-privileged in-game player can crash a PocketMine-MP server and disrupt availability by writing oversized data into a book item.
Affected Products
- PocketMine-MP versions prior to 3.26.5
- PocketMine-MP 4.0.x versions prior to 4.0.5
- Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Discovery Timeline
- 2026-09-07 - CVE-2022-51018 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2022-51018
Vulnerability Analysis
PocketMine-MP does not validate the size of writable book contents received from clients. The server accepts arbitrary text length, arbitrary page counts, and unrestricted author and title fields. When a player writes and signs a book with oversized content, the server serializes that data into an NBT structure attached to the item stack.
Two distinct failure paths exist. In the 3.x branch, book NBT is persisted alongside chunk data in the region-based world format. When the serialized chunk exceeds the 1 MB per-chunk limit imposed by the region file format, the save operation fails and the server terminates. In the 4.x branch, the NBT serializer enforces a TAG_String maximum length of 32 KiB. Oversized book text triggers an exception during serialization and the process aborts.
Root Cause
The root cause is missing input validation on client-supplied book data. The server trusts the length of the pages, author, and title fields transmitted by the client without enforcing upper bounds prior to storing the item in inventory or persisting it to disk.
Attack Vector
Exploitation requires an authenticated connection to the server and access to a writable book item, which is a standard survival-mode item. The attacker edits the book client-side, either through a modified client or by crafting the network packet directly, and submits pages containing megabytes of text. The server accepts the write, then crashes either during world save (PM3) or during NBT serialization (PM4). Repeated payloads also consume bandwidth for every nearby player receiving the inventory update. Refer to the GitHub Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2022-51018
Indicators of Compromise
- Server process crashes correlated with chunk save failures or TAG_String length exceptions in PocketMine-MP logs
- Abnormal outbound bandwidth spikes tied to inventory or item-update packets containing writable book NBT
- Unusually large item entries in world region files or player inventory data
Detection Strategies
- Parse PocketMine-MP server logs for exceptions referencing NBT serialization, TAG_String, or chunk size limits
- Monitor for repeated unexpected server restarts occurring shortly after a specific player joins or interacts with a book
- Correlate crash timestamps with player action logs to identify the account submitting oversized book payloads
Monitoring Recommendations
- Instrument the host running PocketMine-MP with process and log telemetry to alert on crash loops
- Track per-player packet size distributions and flag clients transmitting item NBT above expected thresholds
- Retain server crash dumps and world save errors for post-incident review
How to Mitigate CVE-2022-51018
Immediate Actions Required
- Upgrade PocketMine-MP to version 3.26.5 or later on the 3.x branch
- Upgrade PocketMine-MP to version 4.0.5 or later on the 4.x branch
- Audit active player accounts for suspicious book-writing activity prior to patching
- Restrict access to writable books through server plugins if immediate upgrade is not possible
Patch Information
The PocketMine-MP maintainers fixed the vulnerability in 3.26.5 and 4.0.5 by enforcing limits on book page count, per-page text length, and author and title field length. Patch details are available in the GitHub Security Advisory GHSA-p62j-hrxm-xcxf and the VulnCheck advisory.
Workarounds
- Deploy a server plugin that intercepts book-edit packets and rejects those exceeding safe size thresholds
- Remove or blacklist writable book items from crafting and world generation until the server is patched
- Enforce network-level rate limits on large inbound packets from individual client connections
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.