CVE-2022-51014

PocketMine-MP before 4.0.7 contains an uncaught exception flaw (CWE-248) in its ModalFormResponsePacket handler: when a client sends a form response packet containing invalid or malformed JSON, the handler raises an InvalidArgumentException that is never caught, and the unhandled exception crashes the whole server process. Any player connected to the server can trigger this remotely, so an attacker can repeatedly crash the server at will, gaining a denial of service (CVSS 4.0 rates availability impact as High, with no confidentiality or integrity impact). Only deployments of PocketMine-MP — the popular third-party Minecraft: Bedrock Edition server software — running versions earlier than 4.0.7 are affected; Mojang's official Bedrock servers are not involved. Exploitation is not currently known: there is no public proof-of-concept, the flaw is absent from CISA's KEV, and EPSS assigns only a 0.5% probability of exploitation in the next 30 days.

What to do: Upgrade PocketMine-MP to 4.0.7 or later, where the InvalidArgumentException from the ModalFormResponsePacket handler is handled. Until upgraded, restrict access to trusted or allowlisted players (exploitation requires a connected client) and avoid exposing the server port to the open internet, and check crash logs for InvalidArgumentException entries tied to form response handling.