CVE-2022-51008: Pmmp Pocketmine-Mp

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

Affected products

• Pmmp Pocketmine-Mp: from 4.0.0, before 4.12.3 (fixed in 4.12.3)

Published 2026-09-06. Last modified 2026-09-08.