{"id":"CVE-2025-71418","aliases":["EUVD-2025-210881","GHSA-3rp9-crcm-7w78","GHSA-g274-c6jj-h78p"],"status":"published","title":"PocketMine-MP before 5.25.2 Denial of Service via explode","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00547,"percentile":0.46152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2025-03-10T20:29:26Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","fixed_in":["5.25.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pocketmine/pocketmine-mp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.25.2"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.13.0","3.13.1","3.14.0","3.14.1","3.14.2","3.14.3","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.18.0","3.18.1","3.18.2","3.19.0","3.19.1","3.19.2","3.19.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.20.0","3.21.0","3.21.1","3.22.0","3.22.1","3.22.2","3.22.3","3.22.4","3.22.5","3.23.0","3.23.1","3.24.0","3.25.0","3.25.1","3.25.2","3.25.3","3.25.4","3.25.5","3.25.6","3.26.0","3.26.1","3.26.2","3.26.3","3.26.4","3.26.5","3.27.0","3.28.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.7.0","3.7.1","3.7.2","3.7.3","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7","3.9.8","4.0.0","4.0.0-BETA1","4.0.0-BETA10","4.0.0-BETA11","4.0.0-BETA12","4.0.0-BETA13","4.0.0-BETA14","4.0.0-BETA15","4.0.0-BETA2","4.0.0-BETA3","4.0.0-BETA4","4.0.0-BETA5","4.0.0-BETA6","4.0.0-BETA7","4.0.0-BETA8","4.0.0-BETA9","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0-BETA1","4.1.0-BETA2","4.10.0","4.10.1","4.10.2","4.11.0","4.11.0-BETA1","4.11.0-BETA2","4.12.0","4.12.1","4.12.10","4.12.11","4.12.2","4.12.3","4.12.4","4.12.5","4.12.6","4.12.7","4.12.8","4.12.9","4.13.0","4.13.0-BETA1","4.14.0","4.14.1","4.15.0","4.15.1","4.15.2","4.15.3","4.16.0","4.16.0-BETA1","4.16.0-BETA2","4.17.0","4.17.1","4.17.2","4.18.0","4.18.0-ALPHA1","4.18.0-ALPHA2","4.18.1","4.18.2","4.18.3","4.18.4","4.19.0","4.19.1","4.19.2","4.19.3","4.2.0","4.2.1","4.2.10","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.20.0","4.20.1","4.20.2","4.20.3","4.20.4","4.20.5","4.21.0","4.21.1","4.22.0","4.22.1","4.22.2","4.22.3","4.23.0","4.23.1","4.23.2","4.23.3","4.23.4","4.23.5","4.23.6","4.24.0","4.25.0","4.26.0","4.3.0","4.3.1","4.3.2","4.3.3","4.3.4","4.4.0","4.4.0-BETA1","4.4.1","4.4.2","4.5.0","4.5.1","4.5.2","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.8.1","4.9.0","4.9.1","5.0.0","5.0.0-ALPHA1","5.0.0-ALPHA2","5.0.0-ALPHA3","5.0.0-ALPHA4","5.0.0-ALPHA5","5.0.0-ALPHA6","5.0.0-ALPHA7","5.0.0-ALPHA8","5.0.0-ALPHA9","5.0.0-BETA1","5.0.0-BETA2","5.0.0-BETA3","5.0.0-BETA4","5.0.1","5.1.0","5.1.1","5.1.2","5.1.3","5.10.0","5.11.0","5.11.1","5.11.2","5.12.0","5.12.1","5.13.0","5.14.0","5.14.1","5.15.0","5.16.0","5.17.0","5.17.1","5.18.0","5.18.1","5.19.0","5.2.0","5.2.1","5.20.0","5.20.1","5.21.0","5.21.1","5.21.2","5.22.0","5.23.0","5.23.1","5.23.2","5.23.3","5.24.0","5.25.0","5.25.1","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.5.0","5.5.0-BETA1","5.6.0","5.6.1","5.7.0","5.7.1","5.8.1","5.8.2","5.9.0"]}],"products":[{"vendor":"pmmp","product":"pocketmine-mp"}],"references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.25.2-denial-of-service-via-explode","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71418","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3rp9-crcm-7w78"},{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g274-c6jj-h78p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71418.json","tags":["advisory"]},{"url":"https://github.com/pmmp/PocketMine-MP","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71418","title":"PocketMine-MP before 5.25.2 Denial of Service via explode","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","status":"published","published":"2026-09-09T13:31:57.642Z","modified":"2026-10-08T15:21:36.301Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-210881","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","status":"published","published":"2026-09-09T13:31:57Z","modified":"2026-10-08T15:21:36Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:32.18003Z"}],"ghsa":[{"id":"GHSA-3rp9-crcm-7w78","title":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing,...","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","status":"published","published":"2026-09-09T15:35:10Z","modified":"2026-09-09T15:35:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:11:38.712835Z"},{"id":"GHSA-g274-c6jj-h78p","title":"PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()","description":"### Impact\nDue to lack of limits by default in the [`explode()`](https://www.php.net/manual/en/function.explode.php) function, malicious clients were able to abuse some packets to waste server CPU and memory.\n\nThis is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a wider impact, including but not limited to:\n\n- Sign editing\n- LoginPacket JWT parsing\n- Command parsing\n\nHowever, the estimated impact of these issues is low, due to other limits such as the packet decompression limit.\n\n### Patches\nThe issue was fixed in 5.25.2 via d0d84d4c5195fb0a68ea7725424fda63b85cd831.\n\nA custom PHPStan rule has also been introduced to the project, which will henceforth require that all calls to `explode()` within the codebase must specify the `limit` parameter.\n\n### Workarounds\nNo simple way to fix this.\nGiven that sign editing is the easiest way this could be exploited, workarounds could include plugins pre-processing `BlockActorDataPacket` to check that the incoming text doesn't have more than 4 parts when split by `\\n`.","status":"published","published":"2025-03-10T20:29:26Z","modified":"2025-03-10T20:29:26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2025-71418","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","status":"published","published":"2026-09-09T14:17:10.877Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:03.20248Z"}],"osv":[{"id":"CVE-2025-71418","title":"PocketMine-MP before 5.25.2 Denial of Service via explode","description":"PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.","status":"published","published":"2026-09-09T13:31:57.642Z","modified":"2026-10-28T02:30:46.5337168Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-g274-c6jj-h78p","title":"PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()","description":"### Impact\nDue to lack of limits by default in the [`explode()`](https://www.php.net/manual/en/function.explode.php) function, malicious clients were able to abuse some packets to waste server CPU and memory.\n\nThis is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a wider impact, including but not limited to:\n\n- Sign editing\n- LoginPacket JWT parsing\n- Command parsing\n\nHowever, the estimated impact of these issues is low, due to other limits such as the packet decompression limit.\n\n### Patches\nThe issue was fixed in 5.25.2 via d0d84d4c5195fb0a68ea7725424fda63b85cd831.\n\nA custom PHPStan rule has also been introduced to the project, which will henceforth require that all calls to `explode()` within the codebase must specify the `limit` parameter.\n\n### Workarounds\nNo simple way to fix this.\nGiven that sign editing is the easiest way this could be exploited, workarounds could include plugins pre-processing `BlockActorDataPacket` to check that the incoming text doesn't have more than 4 parts when split by `\\n`.","status":"published","published":"2025-03-10T20:29:26Z","modified":"2026-09-10T03:56:05.165255966Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}