CVE-2022-51011 json
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
published 2022-05-25 4 y ago modified 2026-10-08 32 d ago also GHSA-gj94-v4p9-w672 , EUVD-2022-56040
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.
Patch / fix
- packagist pocketmine/pocketmine-mp 4.2.10
- pmmp PocketMine-MP 4.2.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 1 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pocketmine/pocketmine-mp | <4.2.10 |
4.2.10 |
Affected products
- pmmp PocketMine-MP
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258
patch
-
github.com
/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672
vendor-advisory, web
-
vulncheck.com
/advisories/pocketmine-mp-before-4.2.10-denial-of-service-via-chat-messages
third-party-advisory
-
github.com
/pmmp/PocketMine-MP
package
Sources
- CVE List CVE-2022-51011
- GitHub Advisory GHSA-gj94-v4p9-w672
- NVD CVE-2022-51011
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.