GHSA-5jfw-35xp-5m42
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at team@pmmp.io
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at team@pmmp.io
- Record
GHSA-5jfw-35xp-5m42- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-124
- Updated
- 2026-11-02
OSV
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at team@pmmp.io
- Record
GHSA-5jfw-35xp-5m42- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-124
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pocketmine/bedrock-protocolPackagist | before 8.0.2 | 8.0.2 |
pocketmine/bedrock-protocolPackagist | before 8.0.2, plus listed versions 1.0.0+bedrock-1.17.101.1.0+bedrock-1.17.102.0.0+bedrock-1.17.303.0.0+bedrock-1.17.403.0.1+bedrock-1.17.40 Show 17 moreShow less3.0.2+bedrock-1.17.404.0.0+bedrock-1.17.404.0.1+bedrock-1.17.405.0.0+bedrock-1.17.405.1.0+bedrock-1.17.405.1.1+bedrock-1.17.405.1.2+bedrock-1.17.405.1.3+bedrock-1.17.406.0.0+bedrock-1.17.407.0.0+bedrock-1.18.07.1.0+bedrock-1.18.07.2.0+bedrock-1.18.07.3.0+bedrock-1.18.07.3.1+bedrock-1.18.08.0.0+bedrock-1.18.108.0.1+bedrock-1.18.108.0.2+bedrock-1.18.10 | 8.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5jfw-35xp-5m42 is a high vulnerability (CVSS 7.5) in pocketmine/bedrock-protocol, published April 5, 2022. No source lists public exploit code. Fixed in pocketmine/bedrock-protocol 8.0.2.