Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 32

Export CSV
CVE-2026-86200

PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2024-58380

PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54392

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2021-48006

PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51018

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51013

PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86201

PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2024-58381

PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54393

PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86198

PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51009

PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86203

PocketMine-MP before 5.39.2 Item Duplication via Despawn State

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2025-71417

PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54395

PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2023-54355

PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86199

PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51011

PocketMine-MP before 4.2.10 Denial of Service via Chat Messages

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2022-51016

PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86202

PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp
CVE-2026-86204

PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp