CVE-2022-51009

CVE-2022-51009 is an uncaught-exception flaw (CWE-248) in PocketMine-MP, an open-source server platform for Minecraft: Bedrock Edition, where skin-geometry JSON parsed through the bundled adhocore/json-comment library can raise a RuntimeException that the server does not handle. An unauthenticated network attacker can trigger it simply by sending a login or skin packet containing invalid geometry JSON, requiring no credentials or user interaction (CVSS 4.0 network vector, low complexity). The unhandled exception crashes the server process, producing a full denial-of-service with high availability impact (VA:H) and no confidentiality or integrity impact per the scoring. Any operator running PocketMine-MP versions before 4.7.2 is affected. Exploitation has not been observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days (percentile 27).

What to do: Upgrade to PocketMine-MP 4.7.2 or later, which properly handles the parser exceptions. Operators who cannot upgrade should restrict access to the server's Bedrock protocol port (UDP 19132 by default) to trusted players and monitor for crash/restart events. Confirm the running version from the server's startup banner or logs to verify remediation.