PocketMine-MP (< 3.26.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pocketmine-mp--3.26.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 07 Sep 2026 13:36:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in PocketMine-MPhttps://feed.craftedsignal.io/briefs/2026-09-pocketmine-dos/Mon, 07 Sep 2026 13:36:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-pocketmine-dos/PocketMine-MP versions prior to 3.26.5 and 4.0.5 are vulnerable to a denial-of-service attack due to insufficient validation of player-submitted skin data lengths.PocketMine-MP versions before 3.26.5 and 4.0.5 contain a vulnerability arising from improper input validation regarding the length of skin data fields provided by game clients during the connection process. An attacker can manipulate fields such as skinID or geometryName to exceed the 32767 byte TAG_String limit imposed by the NBT protocol used by the server. When the server attempts to process or serialize this maliciously oversized data, it triggers internal exceptions within the NBT handling logic. If not properly caught or sanitized, these exceptions result in a process crash, effectively rendering the game server unavailable to legitimate players. This vulnerability represents a significant risk to service availability for server administrators operating impacted versions.

Impact

Successful exploitation results in a persistent denial-of-service condition for the targeted PocketMine-MP game server. This disrupts gameplay for all connected users and requires manual administrative intervention to restore service availability. Organizations hosting competitive or public-facing game environments are at the highest risk of repeated service interruptions.

Recommendation

  • Upgrade all instances of PocketMine-MP to version 3.26.5 or 4.0.5 or later to resolve the underlying input validation flaw.
  • Monitor server logs for repeated application-layer crashes or stack trace exceptions involving NBT serialization modules to identify potential exploitation attempts.
  • Implement rate limiting or packet size inspection at the network edge, if possible, to drop incoming game packets that exceed the expected size for skin-related data payloads.
]]>lowadvisorydenial-of-servicevulnerability