pmmp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-86204 PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of servHigh 7.1 · Sep 9, 2026
• CVE-2026-86201 PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT proHigh 8.7 · Sep 9, 2026
• CVE-2026-86199 PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication.High 8.7 · Sep 9, 2026
• CVE-2025-71417 PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clHigh 7.1 · Sep 9, 2026
• CVE-2024-58381 PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendinHigh 8.7 · Sep 9, 2026
• CVE-2024-58380 PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slotHigh 7.1 · Sep 9, 2026
• CVE-2023-54396 PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization.High 7.1 · Sep 9, 2026
• CVE-2023-54393 PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependenHigh 8.7 · Sep 9, 2026
• CVE-2023-54392 PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket.High 7.1 · Sep 9, 2026
• CVE-2023-54390 PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arraHigh 8.7 · Sep 9, 2026
• CVE-2023-54355 PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve.High 8.7 · Sep 9, 2026
• CVE-2022-51018 PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length.High 7.1 · Sep 7, 2026
• CVE-2022-51017 PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 3276High 8.7 · Sep 7, 2026
• CVE-2022-51015 PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typicalHigh 7.1 · Sep 7, 2026
• CVE-2022-51014 PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients.High 7.1 · Sep 7, 2026
• CVE-2022-51013 PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients.High 7.1 · Sep 7, 2026
• CVE-2022-51012 PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients.High 7.1 · Sep 7, 2026
• CVE-2022-51010 PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data.High 7.1 · Sep 7, 2026
• CVE-2022-51009 PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data.High 8.7 · Sep 6, 2026
• CVE-2021-48007 PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields.High 7.1 · Sep 6, 2026
• CVE-2020-37277 PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method.High 7.1 · Sep 6, 2026
• CVE-2023-7332 PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling.High 7.1 · Dec 31, 2025