Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 32

Export CSV
CVE-2023-54390

PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2025-71418

PocketMine-MP before 5.25.2 Denial of Service via explode

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54394

PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54396

PocketMine-MP before 4.8.1 Server Crash via Banner NBT

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51014

PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2021-48007

PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51008

PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51015

PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51010

PocketMine-MP before 4.4.2 Server Crash via Item ID

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2020-37277

PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51017

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51012

PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp