PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()
Impact
Due to lack of limits by default in the explode() function, malicious clients were able to abuse some packets to waste server CPU and memory.
This is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a wider impact, including but not limited to:
- Sign editing
- LoginPacket JWT parsing
- Command parsing
However, the estimated impact of these issues is low, due to other limits such as the packet decompression limit.
Patches
The issue was fixed in 5.25.2 via d0d84d4c5195fb0a68ea7725424fda63b85cd831.
A custom PHPStan rule has also been introduced to the project, which will henceforth require that all calls to explode() within the codebase must specify the limit parameter.
Workarounds
No simple way to fix this.
Given that sign editing is the easiest way this could be exploited, workarounds could include plugins pre-processing BlockActorDataPacket to check that the incoming text doesn't have more than 4 parts when split by \n.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | pocketmine/pocketmine-mp | < 5.25.2 | 5.25.2 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Debilidad (CWE)
CWE-770- Plataforma
- Composer
- Paquete
pocketmine/pocketmine-mp- Publicada
- 10.03.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-g274-c6jj-h78p - CC BY 4.0
Historial de vulnerabilidades: pocketmine/pocketmine-mp
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 30
- Primera → última
- 11.2020 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 20
- Media 8
- Baja 2
Divulgaciones por año
- 2020: 1
- 2021: 1
- 2022: 11
- 2023: 8
- 2024: 2
- 2025: 2
- 2026: 5
-
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.