GHSA-5JFW-35XP-5M42 Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown

Impact LoginPacket uses BinaryStream-getLInt to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream-getLInt returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size which would be interpreted as a...

PT-2022-28200

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified Description The issue arises from the LoginPacket using BinaryStream-getLInt to read JSON payload lengths. Since BinaryStream-getLInt returns a signed integer, a malicious client can craft a packet...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists due to lack of validations in the file upload in the netItemStackToCore function of TypeConverter.php which allows an attacker to cause an application crash...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. An attacker may exploit the vulnerability and crash the system by sending a maliciously crafted MovePlayerPacket to the server whose position or rotation contains NaN or INF...

NaN/INF in serverbound movement packets can crash clients and servers

Impact A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play. - The server may crash in various ways if this exploit is use...

GHSA-FM35-JGG3-3GRX NaN/INF in serverbound movement packets can crash clients and servers

Impact A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play. - The server may crash in various ways if this exploit is use...

PT-2026-86775

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.2.3 Description The software fails to validate damage metadata values in tool and armor item NBT Named Binary Tag data received from clients. Due to a workaround applied in version 1.13, the TypeConverter uses...

PT-2022-28241

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 3.18.1 Description A malicious client can send a MovePlayerPacket to the server with position or rotation containing NaN or INF, causing various side effects. The server may crash due to PHP warnings converted...

PT-2022-28189

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to the version containing commit c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1 Description The issue arises from a workaround applied in version 1.13, allowing an attacker to send a negative damage or meta value in a to...

Insecure Encryption

pocketmine/pocketmine-mp is using insecure encryption. The vulnerability exists in 'Minecraft Bedrock' function, due to authentication and protocol encryption are unchangeable servers are allowed to connect internet directly...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists due to the unhandled exception in the stupidjsondecode function of InGamePacketHandler.php when decoding an invalid JSON response form, which allows an attacker to cause an application crash...

GHSA-H79X-98R2-G6QC Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP

Impact Minecraft Bedrock authentication and its protocol encryption are inseparably linked. One is not complete without the other. This vulnerability affects servers which are able to be directly connected to via the internet i.e. not behind a proxy. If you are using a proxy, please check that it...

PT-2022-28252

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions 3.x Description This issue affects Minecraft Bedrock authentication, where the protocol encryption is inseparably linked to the authentication process. Servers directly connected to the internet are vulnerable, but those...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. An attacker is able to send PlayerActionPacket with invalid facing values e.g. negative, specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket, causing an applicatio...

PT-2022-28291

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified Description A remote attacker may crash a server by sending a PlayerActionPacket with invalid facing values, such as negative values, specifically with START BREAK or CRACK BLOCK actions, or with a...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service DoS. The vulnerability exists as the handleBookEdit class does not limit the size of pages and characters to be fill. which allows an attacker to cause an application crash...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The library does not properly validate byte limit in the skin length resulting in an overflow, allowing an attacker to crash the application...

PT-2026-86780

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 3.26.5 PocketMine-MP versions 4.0.x prior to 4.0.5 Description The software fails to limit the length of book page text, the total page count, or the length of the author and title fields. An attacker with a...

PT-2022-28267

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 3.26.5 PocketMine-MP versions prior to 4.0.5 Description The issue allows players to fill book pages with an excessive number of characters, as the server does not enforce the character limit. Additionally, the...

PT-2022-28232

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified Description The issue arises from uncapped skin data fields, such as skinID and geometryName, which are saved in the NBT data of a player. These fields have a 32767 byte limit due to the TAG String...