Description

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:23.030Z",
  "pubdate": "2026-09-07T13:17:23.030Z",
  "executiveSummary": "PocketMine-MP versions prior to 4.2.9 are susceptible to a Denial of Service (DoS) vulnerability originating from improper validation of Named Binary Tag (NBT) data structures.\nThe vulnerability occurs within the packet processing subsystem responsible for handling inventory transaction packets received from connected clients.\nAn unauthenticated remote attacker can exploit this flaw by crafting and transmitting a malicious inventory transaction containing malformed NBT tags.\nThe server's failure to enforce strict type checking during the deserialization process allows these malformed tags to trigger unhandled exceptions or memory inconsistencies, resulting in a complete server process crash.\nThis impact presents a significant risk to service availability, as it allows external actors to remotely interrupt server operations without requiring prior authentication or administrative privileges.\nThe exploit relies on the server's standard packet handling workflow, making the attack surface directly exposed to any client capable of establishing a network connection to the server.\nImmediate patching is required to address the underlying deserialization logic flaw.",
  "technicalDetails": "The vulnerability resides within the packet handling architecture of PocketMine-MP, specifically in the segment responsible for deserializing inventory transaction packets. The NBT format, used for serializing complex data structures in Minecraft-related protocols, requires rigorous validation to ensure that the data type expected by the deserializer matches the data provided in the packet stream.\nThe root cause is an inadequate validation mechanism during the NBT deserialization process. When an inventory transaction packet is received, the server attempts to parse the embedded NBT structures. Due to the lack of strict type verification, a maliciously crafted NBT payload can force the parser into an undefined or error-prone state.\nAttack flow: An attacker initiates a connection to the PocketMine-MP server. Once a session is established, the attacker sends a specially crafted inventory transaction packet. This packet contains an NBT tag structure that intentionally violates schema expectations—such as providing an unexpected data type for a specific tag ID or introducing nested tag structures that the deserializer cannot safely resolve.\nWhen the server's deserialization logic processes this packet, the malformed NBT data triggers an exception or a logic error within the server's core codebase. If the server does not encapsulate this deserialization routine in sufficiently robust error-handling blocks, the resulting exception propagates upward, causing the entire server process to terminate unexpectedly.\nBecause the server attempts to parse this data immediately upon receipt of the inventory transaction, the attack requires no specific player interaction or administrative privilege level. The vulnerability is effectively a remote crash primitive. The failure to validate NBT types allows the attacker to circumvent standard input sanitization, as the vulnerability lies deeper in the protocol serialization layer rather than the application-level inventory logic.\nPost-exploitation impact is limited to the exhaustion of availability; the process termination effectively halts all game services, kicking all connected players and preventing new connections until the server is manually or automatically restarted. The vulnerability does not provide a direct vector for remote code execution or arbitrary memory read/write, but its impact on operational stability is absolute."
}