Description

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:21.690Z",
  "pubdate": "2026-09-09T14:17:21.690Z",
  "executiveSummary": "PocketMine-MP versions prior to 5.39.2 contain a critical vulnerability in the handling of ModalFormResponsePacket data, categorized as an improper input validation flaw leading to resource exhaustion.\nThe vulnerability allows an authenticated attacker to trigger a Denial of Service (DoS) by submitting maliciously crafted JSON payloads within modal form responses.\nBy sending oversized or deeply nested JSON arrays, an attacker can force the server to allocate excessive heap memory and consume significant CPU cycles during the parsing process.\nThis resource consumption effectively exhausts the host system's available memory and processor capacity, rendering the Minecraft server unresponsive to legitimate client requests and forcing a crash or service termination.\nThe exploitation of this flaw does not require elevated administrative privileges; it is achievable by any authenticated user interacting with the server's form-based systems.\nDue to the ease of execution and the impact on server availability, this vulnerability poses a significant risk to the stability and operational integrity of affected PocketMine-MP instances.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and length limitation of JSON-encoded payloads processed within the ModalFormResponsePacket handling logic in PocketMine-MP.\nWhen a client initiates a modal form response, the server is expected to deserialize the provided JSON data to process the player's interaction. In versions before 5.39.2, the implementation fails to enforce a maximum size constraint on the incoming JSON payload before passing it to the decoder.\nAn attacker can exploit this by crafting a packet containing an exceptionally large or highly complex JSON structure, such as a deeply nested array or a massively redundant object. When the server-side logic attempts to parse this data, the JSON decoder allocates memory proportional to the size and complexity of the payload.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated connection to the PocketMine-MP server. Second, the attacker intercept or simulates the client-side ModalFormResponsePacket mechanism. Third, the attacker injects a malicious payload into the response field. Upon reception, the server immediately attempts to process the payload without verifying its length. This triggers an uncontrolled allocation of memory within the server's heap.\nBecause the server lacks a circuit breaker or threshold check, the memory footprint expands rapidly, potentially leading to an OutOfMemory (OOM) condition. Concurrently, the CPU usage spikes as the parser recursively traverses the deeply nested or bloated structures, leading to thread blocking or event loop starvation.\nThis behavior results in a complete suspension of server responsiveness, effectively locking the main server thread. Since the vulnerability is located at the packet processing layer, it is reachable via the standard network protocol used by Minecraft clients (Bedrock Edition). Any authenticated player session, regardless of their in-game permissions, can initiate this attack. The post-exploitation impact is limited to service interruption, as the vulnerability does not inherently permit remote code execution or unauthorized access to the underlying filesystem, though it remains a severe availability concern for server operators."
}