Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2022-51018

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 3.0.0 to < 3.26.5affected
  • 3.26.5unaffected
  • 4.0.0 to < 4.0.5affected
  • 4.0.5unaffected
pkg:composer/pocketmine/pocketmine-mp

References