p PatchFirst

CVE-2022-51014

CVE-2022-51014 · PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • pocketmine-mp

    Versions
    • ≥ 0, < 4.0.7: Affected (semver)
    • 4.0.7: Not affected (semver)

    Update to 4.0.7

  • pocketmine/pocketmine-mp Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.0.5
    • 4.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.0.7

    Update to 4.0.7

Original sources

Check your server →