Description

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-06T12:17:15.073Z",
  "pubdate": "2026-09-06T12:17:15.073Z",
  "executiveSummary": "PocketMine-MP versions prior to 4.7.2 contain a vulnerability related to improper exception handling when processing skin geometry data.\nThe vulnerability is triggered during the parsing of malformed JSON content provided by clients during the login or skin update process.\nAn attacker can exploit this by sending a specially crafted packet containing invalid geometry JSON, which forces the adhocore/json-comment library to throw an unhandled RuntimeException.\nThis failure leads to an unhandled exception state that crashes the server process, resulting in a Denial of Service (DoS) condition.\nThe vulnerability poses a significant risk to service availability as it allows unauthenticated or authenticated remote attackers to disrupt game server operations with minimal effort.\nSuccessful exploitation does not require advanced privileges beyond the ability to initiate communication with the server.",
  "technicalDetails": "The vulnerability resides within the packet handling logic of PocketMine-MP responsible for processing player skin data. Specifically, the software utilizes the third-party library 'adhocore/json-comment' to parse JSON-encoded geometry data sent by clients via login or skin packets.\nThe root cause is the lack of a robust error-handling mechanism around the parsing invocation. When the provided JSON payload is syntactically invalid or structured in a way that violates the parser's expected schema, the library throws a RuntimeException. Because this exception is not caught within the specific execution context of the packet handler, it propagates up the call stack, causing the entire PHP process to terminate abruptly.\nThe attack flow begins when a malicious client initiates a connection or triggers a skin update packet containing malformed geometry JSON. Upon receipt, the PocketMine-MP server attempts to decode this data using 'adhocore/json-comment'.\nThe parser encounters the malformed input and immediately halts processing, throwing an exception. Since there is no 'try-catch' block wrapping this call, the exception remains unhandled, leading to a fatal error. The server process terminates, effectively kicking all connected players and preventing new connections until the server is manually restarted by an administrator.\nThis vulnerability is highly accessible because it occurs during the early stages of packet handling, often before the authentication process is fully completed or verified, meaning a remote attacker with basic network access to the server can trigger the crash. The lack of validation on the input length or content prior to parsing ensures that the attacker can send arbitrary, invalid payloads to reliably force the server shutdown.\nThe post-exploitation impact is strictly a Denial of Service. No evidence suggests that this vulnerability leads to Remote Code Execution (RCE) or sensitive data disclosure, as the crash occurs during the parsing stage before any unauthorized memory access or logic manipulation can be achieved. However, the ease of exploitability makes it a severe availability threat."
}