CVE-2022-51017

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

State: Published
Severity: 8.7 High
Published: Sep 7, 2026
Updated: Oct 8, 2026
Reserved: Sep 5, 2026

Description

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
PocketMine-MPpmmp	3.0.0 to before 3.26.5Affected 3.26.5Not affected 4.0.0 to before 4.0.5Affected 4.0.5Not affected

References

GitHub Security Advisory (GHSA-c6fg-99pr-25m9)vendor-advisory
Patch Commitpatch
Patch Commitpatch
VulnCheck Advisory: PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Datathird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.