EUVD-2025-210881
GHSA-3rp9-crcm-7w78
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or user interaction; availability impact assessed Low given vendor-confirmed decompression limits bound exploitability; no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.
AnalysisAI
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability by submitting crafted packets containing excessive delimiter characters across sign editing, JWT login, and command parsing endpoints. The root cause is PHP explode() being called without a limit parameter in multiple packet-handling paths, causing the server to allocate unbounded memory arrays proportional to delimiter count in attacker-controlled input. No CISA KEV listing exists, but a proof-of-concept is publicly available via the vendor's GitHub security advisory (GHSA-g274-c6jj-h78p); vendor assessment notes real-world impact is partially mitigated by existing packet decompression size limits already enforced upstream.
Technical ContextAI
PocketMine-MP is a PHP-based Minecraft Bedrock Edition server implementation (CPE: cpe:2.3:a:pmmp:pocketmine-mp:*:*:*:*:*:*:*:*). The root cause (CWE-400: Uncontrolled Resource Consumption) is PHP's explode() function, which when invoked without a limit parameter allocates a PHP array whose element count is determined entirely by how many delimiter occurrences the input string contains - an attacker-controlled value. Three distinct packet-handling paths were exploitable: BlockActorDataPacket for sign editing (splitting on \n in Sign.php and SignText.php), JwtUtils.php for LoginPacket JWT header parsing (splitting on .), and command permission string parsing in Command.php (splitting on ;). The fix in commit d0d84d4c5195fb0a68ea7725424fda63b85cd831 adds explicit limit arguments to all affected explode() calls and introduces a PHPStan static analysis rule (ExplodeLimitRule) to prevent future regressions across the codebase. This is a recurrence of a prior class of issue documented in GHSA-gj94-v4p9-w672, indicating a systemic pattern in how the codebase used this PHP built-in.
RemediationAI
Upgrade to PocketMine-MP 5.25.2, which incorporates the fix from commit d0d84d4c5195fb0a68ea7725424fda63b85cd831; Composer users should run composer require pocketmine/pocketmine-mp:^5.25.2. The vendor advisory is at https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p. If an immediate upgrade is not possible, the vendor-recommended workaround is to deploy a server plugin that pre-processes BlockActorDataPacket to reject incoming sign text containing more than 4 newline-delimited parts - this closes the sign editing vector but does not address JWT or command parsing paths, which remain open. Network-level rate limiting on the Bedrock UDP port (default 19132) can reduce sustained attack throughput but does not eliminate the vulnerability since each individual malicious packet independently triggers the unbounded string split.
More in Pocketmine Mp
View allUnauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Mine
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game serv
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server perfo
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consu
Resource pack handler in PocketMine-MP before 5.44.2 allows connected clients to repeatedly trigger pre-spawn progressio
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today