CVE-2022-51017

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

WS-2022-0004

Some skin data fields e.g. skinID, geometryName are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave. This is problematic due to the 32767 byte limit on "TAGString"s. If any of these fields exceeds 32767...

PT-2022-28232

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified Description The issue arises from uncapped skin data fields, such as skinID and geometryName, which are saved in the NBT data of a player. These fields have a 32767 byte limit due to the TAG String...