Is CVE-2022-51009 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-51009 being exploited in the wild.

How severe is CVE-2022-51009?

High severity, with a CVSS score of 7.5, published 6 September 2026.

Which products and versions are affected?

pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.7.2.

Is there a fix for CVE-2022-51009?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-51009 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2022-51009?

Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-51009: PocketMine-MP denial of service in skin geometry JSON parsing

CVE-2022-51009 · Severity: high · CVSS 7.5 · Published 2026-09-06

PocketMine-MP is a Minecraft server implementation. An unhandled exception during parsing of player skin data allows remote attackers to crash the server by sending login or skin packets with malformed JSON, disrupting service for all connected players.

Technologies: pocketmine/pocketmine-mp (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2022-51009 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-51009 being exploited in the wild.
How severe is CVE-2022-51009?: High severity, with a CVSS score of 7.5, published 6 September 2026.
Which products and versions are affected?: pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.7.2.
Is there a fix for CVE-2022-51009?: Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-51009 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2022-51009?: Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pocketmine/pocketmine-mp (Packagist): upgrade to 4.7.2 or later
```
composer require pocketmine/pocketmine-mp:^4.7.2
```

Technical details

The vulnerability is a denial of service caused by inadequate exception handling in the Skin class when parsing JSON skin geometry data using the adhocore/json-comment library. The library throws a RuntimeException on invalid JSON, but PocketMine-MP expected a boolean return value and did not catch the exception. An unauthenticated attacker on the network can trigger the crash by sending a login packet or player skin packet containing invalid geometry JSON, with no user interaction required. The fix (commit c9626c6) adds proper exception handling around the commented JSON decoder.

Affected products

PocketMine PocketMine-MP before 4.7.2

Identifiers

CVE-2022-51009
GHSA-8cwq-4cmf-px73

Timeline

2022-08-16: disclosed
2022-08-16: patched: version 4.7.2 released with fix commit c9626c6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.