Description
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | 3.0.0 – < 3.26.5, 4.0.0 – < 4.0.5 | 3.26.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 3.26.5 | 3.26.5 | GHSA-c6fg-99pr-25m9 |
| Packagist | pocketmine/pocketmine-mp | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-c6fg-99pr-25m9 |
References
- GitHub Security Advisory (GHSA-c6fg-99pr-25m9) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data third-party-advisory