Description
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 4.2.9 | 4.2.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 4.2.9 | 4.2.9 | GHSA-g5rr-p69h-7v3g |
References
- GitHub Security Advisory (GHSA-g5rr-p69h-7v3g) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization third-party-advisory