VULNERABILITY INTELLIGENCE

CVE-2022-51017

CVSS score8.7 HIGH

EPSS probability0.63%

CISA KEVNot currently listed

Published2026-09-07

Last modified2026-10-08

Description

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.