Executive brief
PocketMine-MP is a server software for the Minecraft Pocket Edition game that processes player skin data. Attackers can submit oversized skin field values (skinID, geometryName, geometryData) that bypass length validation, causing the server to crash when attempting to serialize the data—resulting in complete service outage for all players on the affected server.
Technical details
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the maximum length of skin data fields submitted by players, allowing values to exceed the 32767 byte limit imposed by the NBT (Named Binary Tag) TAG_String format. An unauthenticated attacker on the network can send a crafted player join/update packet with oversized skinID, geometryName, or geometryData fields. When the server attempts to serialize this data to NBT format, an exception is triggered, crashing the server process. The vulnerability requires network access to the game server but no prior authentication. Patches are available in versions 3.26.5 and 4.0.5, which add explicit length validation to these fields before serialization.
Affected products
- PocketMine PocketMine-MP before 3.26.5 and 4.0.5
Timeline
- 2022-09-07: disclosed
- 2022: patched: Fixes available in versions 3.26.5 and 4.0.5