Executive brief
PocketMine-MP is a Minecraft server software used by game server operators. A vulnerability in how the server processes login messages allows attackers to send specially crafted network packets that crash the server, causing a denial of service that disrupts gameplay for all connected players.
Technical details
The vulnerability is a denial of service flaw in the LoginPacket JSON parsing code, stemming from improper validation in the JsonMapper dependency (specifically issue #210 in cweiske/JsonMapper). An unauthenticated attacker on the network can send malformed JSON structures within LoginPacket messages to trigger a crash on the server. The attack requires network access to the Minecraft server port but no prior authentication. The flaw was resolved by switching to a maintained fork of JsonMapper that addresses the validation issue. Patch version 4.20.5 and later contain the fix.
Affected products
- PocketMine PocketMine-MP before 4.20.5
Timeline
- 2026-09-09: disclosed: Published on NVD
- 2026-09-09: patched: Fixed in version 4.20.5