Description
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pmmp PocketMine-MP
Default version status: unaffected
3.0.0 to < 3.26.5affected3.26.5unaffected4.0.0 to < 4.0.5affected4.0.5unaffected
pkg:composer/pocketmine/pocketmine-mpReferences
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-c6fg-99pr-25m9 ↗
- https://github.com/pmmp/PocketMine-MP/commit/958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb ↗
- https://github.com/pmmp/PocketMine-MP/commit/6492cac5c10f9fa8443ceddd2191a7b65b73f601 ↗
- https://www.vulncheck.com/advisories/pocketmine-mp-before-3.26.5-and-4.0.5-denial-of-service-via-skin-data ↗