Every CVE Search/ Get API key

CVE-2022-51017

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

8.7 HighFix available

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.63%Up 0.2 points since Sep 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Record
CVE-2022-51017
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2022-56046 8.7

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Record
EUVD-2022-56046
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c6fg-99pr-25m9 7.5

Uncapped length of skin data fields submitted by players

Impact

Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.

This is problematic due to the 32767 byte limit on TAG_Strings. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.

Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.

Patches

PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601

Workarounds

A plugin may check player skins during PlayerLoginEvent and PlayerSkinChangeEvent and ensure that the offending fields are not larger than 32767 bytes.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-c6fg-99pr-25m9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q675-2qq9-hxh3 8.7

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields...

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Record
GHSA-q675-2qq9-hxh3
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 8.7

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Record
CVE-2022-51017
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.7

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Record
CVE-2022-51017
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-c6fg-99pr-25m9 7.5

Uncapped length of skin data fields submitted by players

Impact

Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.

This is problematic due to the 32767 byte limit on TAG_Strings. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.

Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.

Patches

PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601

Workarounds

A plugin may check player skins during PlayerLoginEvent and PlayerSkinChangeEvent and ensure that the offending fields are not larger than 32767 bytes.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-c6fg-99pr-25m9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pocketmine/pocketmine-mp
Packagist
 before 3.26.5
3.26.5
pocketmine/pocketmine-mp
Packagist
 4.0.0 up to 4.0.5
4.0.5
pocketmine/pocketmine-mp
Packagist
 before 3.26.5, plus listed versions
3.0.03.0.13.0.103.0.113.0.12
Show 45 moreShow less
3.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.1.83.10.03.10.13.11.03.11.13.11.23.11.33.11.43.11.53.11.63.11.73.12.03.12.13.12.23.12.33.12.43.12.53.12.63.13.03.13.13.14.03.14.13.14.23.14.33.15.03.15.13.15.23.15.33.15.4
3.26.5
pocketmine/pocketmine-mp
Packagist
 4.0.0 up to 4.0.5, plus listed versions
4.0.14.0.24.0.34.0.4
4.0.5

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-51017 is a high vulnerability (CVSS 8.7) in Pmmp Pocketmine-mp, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in pocketmine/pocketmine-mp 3.26.5.

References

This page doesn't list everything

Left out here: 100 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open