CVE-2022-51008

    Dashboard / Vulnerabilities / CVE-2022-51008

    CVE-2022-51008

    Published: 6 Sept 2026Last Modified: 10 Sept 2026

    Summary: PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions

    Details: PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51008.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-474q-9hgp-hcvx, https://nvd.nist.gov/vuln/detail/CVE-2022-51008, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.3-denial-of-service-via-unauthenticated-sessions, https://github.com/pmmp/PocketMine-MP/commit/59be901efe6b7833e69e638e0e1497051ce96fa7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 468faa464b2bc5c97f23fafbb71ea61035f6f218
    Fixed -466f7e98ed339681b46eea5a323bebbf07077721

    Affected versions

    4.12.2
    4.12.1
    4.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-51008 | CVE-DB