Every CVE Search/ Get API key

CVE-2022-51018

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

7.1 HighFix available

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.44%Unchanged since Sep 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Record
CVE-2022-51018
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2022-56047 7.1

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Record
EUVD-2022-56047
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p62j-hrxm-xcxf 6.5

Book page text, count, and author/title length is not limited in PocketMine-MP

Impact

Players can fill book pages with as many characters as they like; the server does not check this. In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:

  • Oversized NBT on the wire costing excess bandwidth for server and client
  • Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
  • Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

Patches

The bug has been fixed in 3.26.5 and 4.0.5.

Workarounds

Ban writable books, or use a plugin to cancel PlayerEditBookEvent to cancel the event if strlen(text) > 1024 || mb_strlen(text) > 256.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-p62j-hrxm-xcxf
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q643-57w3-775x 7.1

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page...

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Record
GHSA-q643-57w3-775x
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.1

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Record
CVE-2022-51018
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.1

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).

Record
CVE-2022-51018
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-p62j-hrxm-xcxf 6.5

Book page text, count, and author/title length is not limited in PocketMine-MP

Impact

Players can fill book pages with as many characters as they like; the server does not check this. In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:

  • Oversized NBT on the wire costing excess bandwidth for server and client
  • Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
  • Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

Patches

The bug has been fixed in 3.26.5 and 4.0.5.

Workarounds

Ban writable books, or use a plugin to cancel PlayerEditBookEvent to cancel the event if strlen(text) > 1024 || mb_strlen(text) > 256.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-p62j-hrxm-xcxf
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pocketmine/pocketmine-mp
Packagist
 before 3.26.5
3.26.5
pocketmine/pocketmine-mp
Packagist
 4.0.0 up to 4.0.5
4.0.5
pocketmine/pocketmine-mp
Packagist
 before 3.26.5, plus listed versions
3.0.03.0.13.0.103.0.113.0.12
Show 45 moreShow less
3.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.1.83.10.03.10.13.11.03.11.13.11.23.11.33.11.43.11.53.11.63.11.73.12.03.12.13.12.23.12.33.12.43.12.53.12.63.13.03.13.13.14.03.14.13.14.23.14.33.15.03.15.13.15.23.15.33.15.4
3.26.5
pocketmine/pocketmine-mp
Packagist
 4.0.0 up to 4.0.5, plus listed versions
4.0.14.0.24.0.34.0.4
4.0.5

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-51018 is a high vulnerability (CVSS 7.1) in Pmmp Pocketmine-mp, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in pocketmine/pocketmine-mp 3.26.5.

References

This page doesn't list everything

Left out here: 100 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open