Description

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T13:17:23.747Z",
  "pubdate": "2026-09-07T13:17:23.747Z",
  "executiveSummary": "PocketMine-MP versions prior to 3.26.5 and 4.0.5 are susceptible to a Denial-of-Service (DoS) vulnerability originating from improper input validation of client-submitted skin data fields.\nThe vulnerability allows remote, unauthenticated attackers to trigger server-side exceptions by transmitting malformed or oversized skin metadata, specifically within fields like 'skinID' and 'geometryName'.\nThese fields bypass existing length constraints, leading to a violation of the 32767-byte limit defined for NBT (Named Binary Tag) TAG_String types during the serialization process.\nWhen the server attempts to process these payloads, the resulting exception causes the application process to terminate, effectively crashing the server instance.\nThe attack is highly accessible as it does not require authentication or elevated privileges, allowing any actor capable of establishing a connection to the server to disrupt service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation of client-provided skin metadata sent during the initial login or player-update handshakes. Specifically, the PocketMine-MP server infrastructure failed to enforce strict length checks on fields such as 'skinID' and 'geometryName' before these values were passed to the NBT data serialization layer.\nThe Minecraft network protocol utilizes NBT for structured data representation. Within the NBT specification, the TAG_String type is strictly limited to 32767 bytes for its length prefix. When the server processes incoming skin data, it proceeds to serialize these fields into an NBT structure. If the submitted data exceeds this length, the serialization engine triggers a runtime exception due to the buffer overflow or format violation of the TAG_String header.\nThe attack flow begins when an attacker crafts a malicious packet containing a skin payload where the byte count of 'skinID' or 'geometryName' exceeds the 32767-byte threshold. The attacker transmits this packet to the target PocketMine-MP server. The server’s network listener receives the packet and passes the payload to the skin validation logic. Because the validation logic fails to cap or truncate these strings before reaching the NBT serialization function, the malformed data is processed as valid input.\nUpon reaching the serialization phase, the internal PHP exception is thrown when the NBT codec encounters a string length that cannot be represented within the 16-bit unsigned integer length field of the TAG_String. If not caught or handled gracefully by the server's main loop, this exception propagates, leading to an unhandled crash of the server process.\nThis vulnerability is particularly critical because it requires no prior authentication; the attack is performed during the early stages of network communication. The impact is a total loss of availability for all connected players. No complex memory corruption techniques or RCE (Remote Code Execution) vectors are required for exploitation, making it a highly reliable and trivial DoS primitive against unpatched instances."
}