PT-2026-86779

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT dat...