CVE-2022-51011

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.5% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-25)

CWE

CWE-20

Published

2026-09-07

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672
• https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.10-denial-of-service-via-chat-messages

Check your stackJSON