Description

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-09T14:17:10.877Z",
  "pubdate": "2026-09-09T14:17:10.877Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.25.2 are susceptible to a resource exhaustion vulnerability caused by improper input validation during packet parsing.\nThe vulnerability stems from the unrestrained use of the explode() function when processing client-supplied packets, specifically within sign editing, JWT parsing, and command parsing logic.\nBy transmitting maliciously crafted packets containing an excessive number of delimiters, an attacker can induce significant CPU and memory consumption on the server.\nThis impact can lead to a Denial of Service (DoS) state, where the server becomes unresponsive to legitimate client requests due to exhausted system resources.\nThe attack is network-exploitable, requiring only the ability to communicate with a running PocketMine-MP instance.\nNo specific authentication or high-level privileges are required to initiate the attack, making it accessible to remote malicious actors.\nThe risk implication is high for server stability, as the vulnerability permits unauthenticated clients to disrupt service availability through resource starvation.",
  "technicalDetails": "The vulnerability is rooted in the lack of input length or delimiter count validation during the parsing of specific packet types within the PocketMine-MP networking layer. The application utilizes the PHP explode() function to tokenize string-based data received from client packets without implementing constraints on the resulting array size or the processing complexity associated with string splitting.\nWhen a client transmits a crafted packet targeting sign editing, JWT (JSON Web Token) parsing, or command parsing endpoints, the server's parser attempts to split the payload based on provided delimiters. Because the number of delimiters is not capped, an attacker can inject a payload containing a high frequency of specified delimiter characters. This forces the underlying PHP engine to allocate significant memory for the resulting array and consumes excessive CPU cycles to process the fragmented string data.\nThe attack flow begins with the malicious actor establishing a network connection to the PocketMine-MP server. The attacker then constructs a packet containing a payload designed to maximize the computational overhead of the vulnerable parsing functions. By flooding these specific endpoints with such payloads, the attacker triggers recursive or high-volume string processing tasks that block the main execution thread or saturate the server's memory heap.\nThe vulnerable component involves the packet processing subsystem where input string sanitization is absent. The scope of impact includes any server endpoint that utilizes explode() on user-controlled input without prior validation of input length or structure. Since PocketMine-MP processes these packets as part of its standard network protocol operations, the exploitation occurs before traditional command or logic validation layers are reached.\nVersions of PocketMine-MP before 5.25.2 are confirmed to be vulnerable. Because this vulnerability targets the fundamental packet parsing logic, it does not require the attacker to have administrative privileges or existing server state manipulation; the exploitation is immediate upon receipt of the crafted packet. The post-exploitation impact is primarily the degradation or complete cessation of server operations, forcing a crash or rendering the server unable to handle legitimate player traffic due to thread starvation."
}