WS-2022-0004

Some skin data fields e.g. skinID, geometryName are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave. This is problematic due to the 32767 byte limit on "TAGString"s. If any of these fields exceeds 32767...

PT-2022-28232

Name of the Vulnerable Software and Affected Versions PocketMine-MP affected versions not specified Description The issue arises from uncapped skin data fields, such as skinID and geometryName, which are saved in the NBT data of a player. These fields have a 32767 byte limit due to the TAG String...