CVE-2022-51017: Pmmp Pocketmine-Mp

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Affected products

• Pmmp Pocketmine-Mp: from 3.0.0, before 3.26.5 (fixed in 3.26.5); from 4.0.0, before 4.0.5 (fixed in 4.0.5)

Published 2026-09-07. Last modified 2026-10-08.