CVE-2022-51009

    Dashboard / Vulnerabilities / CVE-2022-51009

    CVE-2022-51009

    Published: 6 Sept 2026Last Modified: 12 Sept 2026

    Summary: PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

    Details: PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51009.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8cwq-4cmf-px73, https://nvd.nist.gov/vuln/detail/CVE-2022-51009, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.7.2-denial-of-service-via-skin-geometry, https://github.com/pmmp/PocketMine-MP/commit/c9626c610b8f6810c8c987559c9197b2a291f0bb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e4a5defabbba7734d29c267d47bf8f00fcfffe89

    Affected versions

    4.7.1
    4.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-51009 | CVE-DB