Description

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:23.893Z",
  "pubdate": "2026-09-07T13:17:23.893Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw in PocketMine-MP, specifically concerning the processing of writable book items. The lack of constraints on book page count, character length, and metadata fields (author/title) allows authenticated users to inject oversized NBT (Named Binary Tag) data.\nThe primary impact of this 'book bomb' is server instability, manifesting as denial-of-service (DoS) conditions through excessive bandwidth consumption, memory exhaustion, or crashes triggered by exceeding serialized data size limits.\nAffected products include PocketMine-MP versions prior to 3.26.5 and 4.0.x versions prior to 4.0.5. The risk is elevated because the exploitation requires only basic in-game interactions, allowing an authenticated player to craft a malicious payload that triggers internal server constraints.\nSpecifically, the payload can cause the server to exceed the 1 MB chunk size limit during world serialization in PM3 or breach the 32 KiB TAG_String limit in PM4, both of which lead to critical processing errors. The vulnerability represents a significant availability risk for server operators, as it provides a trivial mechanism for malicious actors to crash game instances.",
  "technicalDetails": "The root cause of this vulnerability is the absence of server-side validation for NBT data associated with writable book items. PocketMine-MP failed to enforce strict limits on the number of pages, the character count per page, and the length of the author and title metadata fields. Consequently, a user can craft a book object containing arbitrary amounts of data, creating an oversized NBT structure.\nIn PocketMine-MP 3.x, the exploit leverages the server's region-based world serialization process. When the server attempts to save world data to disk, the oversized NBT object causes the chunk data to exceed the 1 MB storage limit. This results in the server failing to correctly serialize or save the chunk, leading to immediate system crashes or data corruption.\nIn PocketMine-MP 4.x, the exploit targets the NBT serialization protocol specifically regarding TAG_String limits. The server enforces a 32 KiB limit on individual string fields within NBT structures. By crafting a book with page text that exceeds this threshold, the server encounters a buffer overflow or serialization error when attempting to read or write the NBT payload, triggering an exception that forces the server to terminate the process.\nThe attack flow proceeds as follows: 1) The attacker obtains a writable book item within the game. 2) The attacker uses an external client or modification to alter the book's NBT data, injecting a payload that exceeds the defined size or length constraints. 3) The attacker places this book into an inventory, chest, or frame, triggering a server-side read/write operation. 4) The server attempts to serialize this oversized NBT data during a save or packet broadcast cycle. 5) The server crashes due to the inability to handle the oversized payload, resulting in a denial-of-service for all connected users.\nThis vulnerability is reachable by any player with access to the game environment, as the server implicitly trusts the NBT data received from the client for these objects without validating them against server-side policy. This lack of sanitization exposes the internal memory and storage logic to malformed payloads, making it an effective vector for disrupting server availability."
}