CVE-2022-51018

PocketMine-MP, a widely used third-party Minecraft Bedrock Edition server, does not limit writable-book page text length, page count, or author/title length. Any connected player who can obtain a writable book can craft extremely large NBT data ('book bombs'), causing excess bandwidth consumption and server crashes when the oversized data is saved — exceeding the 1 MB chunk-size limit in the 3.x branch or the 32 KiB TAG_String limit in the 4.x branch. An attacker therefore gains remote denial of service of the affected server (CVSS 4.0 rates the availability impact high) with only low privileges and no user interaction. Operators running PocketMine-MP before 3.26.5 or 4.0.x before 4.0.5 are affected. No public proof-of-concept or known in-the-wild exploitation has been reported; EPSS estimates roughly 0.4% probability of exploitation within 30 days and it is not in CISA KEV.

What to do: Upgrade to PocketMine-MP 3.26.5 on the 3.x branch or 4.0.5 or later on the 4.x branch. Until patched, consider restricting players' access to writable books or adding server-side limits on book page count and page/title length, and watch for anomalous bandwidth use or crash loops. Verify the deployed server version in startup logs before applying the fix.