Description
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 4.7.2 | 4.7.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 4.7.2 | 4.7.2 | GHSA-8cwq-4cmf-px73 |
References
- GitHub Security Advisory (GHSA-8cwq-4cmf-px73) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry third-party-advisory