CVE-2022-51017

PocketMine-MP, a popular open-source third-party server implementation for Minecraft Bedrock Edition, fails to validate the length of player-submitted skin data fields before serializing them into NBT. An unauthenticated attacker can connect to the server and send skin fields such as skinId or geometryName exceeding the 32767-byte TAG_String limit, triggering an exception during NBT serialization. The result is a full server crash, giving the attacker a network-reachable denial of service with high availability impact and no confidentiality or integrity impact (CVSS 4.0: 8.7). All deployments running PocketMine-MP before 3.26.5 on the 3.x branch or before 4.0.5 on the 4.x branch are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known; EPSS is 0.5% (39th percentile) and the issue is not in CISA KEV.

What to do: Upgrade PocketMine-MP to 3.26.5 or later on the 3.x branch, or to 4.0.5 or later on the 4.x branch, and verify the running version in server startup logs. If an immediate upgrade is not possible, restrict exposure of the Minecraft Bedrock UDP port (default 19132) to trusted networks and monitor for repeated crash loops as a sign of probing or attacks.