Executive brief
PocketMine-MP is a server implementation for Minecraft Pocket Edition. Malicious clients can send specially crafted packets with excessive delimiters to trigger unbounded string splitting operations, consuming server CPU and memory resources and potentially disrupting service availability for legitimate players.
Technical details
The vulnerability is a denial-of-service flaw in packet parsing logic where multiple code paths use PHP's explode() function without specifying a limit parameter. Attackers can send malicious packets with excessive delimiters (particularly via sign editing, JWT parsing, and command parsing endpoints) to create very large arrays, wasting server CPU and memory. The attack requires network access and no authentication or user interaction. The issue was patched in version 5.25.2 by adding mandatory limit parameters to explode() calls and introducing a PHPStan rule to prevent future occurrences.
Affected products
- PocketMine PocketMine-MP before 5.25.2
Timeline
- 2025-03-09: disclosed
- 2025-03-04: patched: Patch released in version 5.25.2