PocketMine-MP EUVD-2025-210881

Any client that can establish a Bedrock protocol connection to the PocketMine-MP server can trigger this vulnerability - no game authentication, no operator privileges, and no non-default server configuration is required (CVSS PR:N/UI:N). Three distinct unauthenticated entry points exist: sending a LoginPacket JWT string with excessive . delimiters (reachable before authentication completes), sending a BlockActorDataPacket with excessive \n characters in sign text (reachable after initial connection), and sending command strings with excessive ; delimiters via command permission parsing. Exploitation is partially limited by existing packet decompression size limits already enforced server-side, which bound the maximum delimiter-laden payload the server will process; the vendor explicitly acknowledges this reduces overall impact to 'low'. No special network position, no elevated client permissions, and no specific server plugin configuration are needed - all three attack surfaces are part of standard PocketMine-MP server operation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) scores 6.9, reflecting a remotely exploitable, zero-complexity DoS with low availability impact on the vulnerable system and no confidentiality or integrity impact. No EPSS score is present in the supplied intelligence. No KEV listing exists, and no confirmed threat-actor exploitation has been reported. The public exploit reference in the GHSA advisory lowers the effective exploitation barrier significantly - the vulnerable code paths and delimiter types are explicitly documented. Real-world impact is constrained by packet decompression limits that bound practical payload size, meaning a sustained stream of crafted connections would be needed for meaningful degradation rather than a single packet achieving instant denial. Small game-hosting operators running unpatched PocketMine-MP instances face measurable player-facing disruption without necessarily experiencing a full outage. On balance, this is a moderate-priority patch for active game servers: real but bounded impact, unauthenticated attack surface, and a trivially simple public exploit.

An unauthenticated Minecraft Bedrock client connects to a PocketMine-MP server and transmits a LoginPacket whose JWT field contains a string consisting of thousands of . characters, causing the server's JwtUtils::parse() to invoke explode('.', $jwt) without a limit and allocate a large PHP array on each call. An attacker repeats this across rapid successive connections, or combines it with sign-editing packets containing thousands of \n characters, compounding cumulative CPU and memory pressure until legitimate players experience lag or disconnection. Full exploit details are publicly available via the vendor's GHSA advisory.