CVE-2025-71418: PocketMine-MP DOS Vulnerability

CVE-2025-71418 Overview

CVE-2025-71418 affects PocketMine-MP, a server software implementation of the Minecraft: Bedrock Edition protocol written in PHP. Versions before 5.25.2 fail to set a limit on explode() calls used during packet parsing. Malicious clients can send crafted packets containing excessive delimiters to exhaust CPU and memory on the server. The impacted parsing paths include sign editing, JSON Web Token (JWT) parsing, and command parsing endpoints. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Unauthenticated remote attackers can degrade or crash PocketMine-MP servers by transmitting packets with excessive delimiters, wasting CPU and memory resources.

Affected Products

PocketMine-MP versions prior to 5.25.2
Sign editing packet handler
JWT parser used during client login
Command parsing endpoint

Discovery Timeline

2026-09-09 - CVE-2025-71418 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2025-71418

Vulnerability Analysis

The vulnerability stems from calls to PHP's explode() function without the optional limit parameter. When invoked without a limit, explode() splits a string on every occurrence of the delimiter and returns the full array. An attacker who controls the input can force the function to allocate an unbounded number of array elements.

Inside PocketMine-MP, this pattern appears in packet parsing routines that process untrusted network data. A client can submit sign text, a malformed JWT, or a crafted command string filled with delimiter characters. The server then spends CPU cycles on string splitting and consumes memory holding the resulting arrays.

Because the affected endpoints are reachable before or during authentication, an unauthenticated attacker on the network can trigger the condition. Repeated requests amplify the resource pressure and can render the server unresponsive.

Root Cause

The root cause is missing bounds enforcement on user-controlled input during string splitting. PHP's explode() accepts a third limit argument that caps the number of returned segments. PocketMine-MP omitted this argument in the affected code paths, which permits O(n) allocation controlled by attacker input.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends packets whose fields contain many delimiter characters through sign editing, JWT parsing, or command parsing entry points. The server parses each field with unbounded explode() calls, consuming CPU and memory until service degrades.

php

// Source: https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831
// Security patch in build/dump-version-info.php
$options = [
    "base_version" => VersionInfo::BASE_VERSION,
-   "major_version" => fn() => explode(".", VersionInfo::BASE_VERSION)[0],
+   "major_version" => fn() => explode(".", VersionInfo::BASE_VERSION, limit: 2)[0],
    "mcpe_version" => ProtocolInfo::MINECRAFT_VERSION_NETWORK,
    "is_dev" => VersionInfo::IS_DEVELOPMENT_BUILD,
    "changelog_file_name" => function() : string{

The patch adds an explicit limit argument to every explode() call. A new PHPStan rule enforces this project-wide:

text

# Source: https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831
# phpstan.neon.dist - new static analysis rule
- pocketmine\phpstan\rules\DeprecatedLegacyEnumAccessRule
- pocketmine\phpstan\rules\DisallowEnumComparisonRule
- pocketmine\phpstan\rules\DisallowForeachByReferenceRule
+ - pocketmine\phpstan\rules\ExplodeLimitRule
- pocketmine\phpstan\rules\UnsafeForeachArrayOfStringRule

Detection Methods for CVE-2025-71418

Indicators of Compromise

Sudden spikes in PHP process CPU and resident memory on PocketMine-MP hosts without matching player counts.
Inbound packets from a single client containing sign text, JWT fields, or command strings with an unusually high count of ., |, or other delimiter characters.
Server watchdog timeouts, tick-lag warnings, or out-of-memory errors in PocketMine-MP logs.
Repeated login attempts from the same source IP that never complete authentication.

Detection Strategies

Alert on PocketMine-MP server process memory or CPU usage exceeding baseline thresholds during idle or low-player periods.
Inspect Minecraft Bedrock protocol traffic for oversized sign-update, login, or command packets and correlate with client source addresses.
Correlate repeated tick timing warnings in PocketMine-MP logs with network flows from specific clients.

Monitoring Recommendations

Enable verbose logging on packet handlers for signs, login/JWT, and commands, and forward the logs to a central store for review.
Track per-client packet size distributions and flag outliers that exceed protocol norms.
Monitor for repeated server restarts or crashes and correlate with recent network sources.

How to Mitigate CVE-2025-71418

Immediate Actions Required

Upgrade PocketMine-MP to version 5.25.2 or later on all production and staging servers.
Restrict inbound access to the Minecraft Bedrock port to known IP ranges where feasible.
Rate-limit new client connections at the network edge to reduce amplification of resource abuse.
Review server logs for prior tick-lag or memory pressure events that may indicate earlier exploitation attempts.

Patch Information

The fix is delivered in PocketMine-MP 5.25.2. The upstream commit adds explicit limit arguments to explode() calls and introduces the ExplodeLimitRule PHPStan rule to prevent regression. Additional context is available in the GitHub Security Advisory GHSA-g274-c6jj-h78p and the VulnCheck Denial of Service Advisory.

Workarounds

Place the server behind a reverse proxy or firewall that limits packet size and connection rate per source.
Disable public exposure of the server and require whitelisted clients until the patch is applied.
Enforce process-level resource limits (for example, systemdMemoryMax and CPUQuota) to contain runaway parsing.

bash

# Upgrade PocketMine-MP to the patched release
git -C /opt/PocketMine-MP fetch --tags
git -C /opt/PocketMine-MP checkout 5.25.2
composer install --no-dev --optimize-autoloader

# Optional: constrain the service with systemd resource limits
# /etc/systemd/system/pocketmine.service.d/limits.conf
[Service]
MemoryMax=2G
CPUQuota=200%