{"id":"CVE-2022-51014","aliases":["EUVD-2022-56043","GHSA-5fxr-c74g-3268","GHSA-wjfq-88q2-r34j"],"status":"published","title":"PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0053,"percentile":0.45124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2022-01-21T23:02:14Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","fixed_in":["4.0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6"]}],"products":[{"vendor":"pmmp","product":"pocketmine-mp"}],"references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.7-denial-of-service-via-json-decoding","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51014","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5fxr-c74g-3268"},{"url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.7/changelogs/4.0.md#407","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wjfq-88q2-r34j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51014.json","tags":["advisory"]},{"url":"https://github.com/pmmp/PocketMine-MP","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-51014","title":"PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","status":"published","published":"2026-09-07T12:55:07.817Z","modified":"2026-10-08T15:20:56.955Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:34:27.327929Z"}],"euvd":[{"id":"EUVD-2022-56043","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","status":"published","published":"2026-09-07T12:55:07Z","modified":"2026-10-08T15:20:56Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:32.18003Z"}],"ghsa":[{"id":"GHSA-5fxr-c74g-3268","title":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the...","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","status":"published","published":"2026-09-07T15:33:51Z","modified":"2026-09-07T15:33:55Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:11:26.557204Z"},{"id":"GHSA-wjfq-88q2-r34j","title":"Unhandled exception when decoding form response JSON","description":"### Impact\nWhen handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.\n\nAn `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.\n\n### Patches\n56fe71d939c38fe14e18a31a673a9331bcc0e4ca\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.\n\nNote that this requires copying the body of the function to a plugin, since the function is currently private.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","status":"published","published":"2022-01-21T23:02:14Z","modified":"2025-12-26T17:29:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:39:15.106458Z"}],"nvd":[{"id":"CVE-2022-51014","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","status":"published","published":"2026-09-07T13:17:23.317Z","modified":"2026-10-08T16:16:46.453Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:07:43.752276Z"}],"osv":[{"id":"CVE-2022-51014","title":"PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding","description":"PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.","status":"published","published":"2026-09-07T12:55:07.817Z","modified":"2026-10-28T02:31:05.001944429Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:44:29.084154Z"},{"id":"GHSA-wjfq-88q2-r34j","title":"Unhandled exception when decoding form response JSON","description":"### Impact\nWhen handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.\n\nAn `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.\n\n### Patches\n56fe71d939c38fe14e18a31a673a9331bcc0e4ca\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.\n\nNote that this requires copying the body of the function to a plugin, since the function is currently private.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","status":"published","published":"2022-01-21T23:02:14Z","modified":"2026-09-08T12:38:31.849447888Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}