CVE-2022-51017

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-51017
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-51017.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-51017
Aliases
Published
2026-09-07T12:55:09Z
Modified
2026-10-21T02:49:18Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
Details

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51017.json"
}
References

Affected packages

Git / github.com/pmmp/pocketmine-mp

Affected ranges

Type
GIT
Repo
https://github.com/pmmp/pocketmine-mp
Events
Introduced
03510333dcec34fa5a59191e8e9610a9da5765ef
Fixed
a4af1609eaf42eff5effe04b08f2c1402d408f3d
Introduced
468faa464b2bc5c97f23fafbb71ea61035f6f218
Fixed
e7d17eb4d327f6573ae702273e3838305844d2d6
Fixed
958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb
Fixed
6492cac5c10f9fa8443ceddd2191a7b65b73f601
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.26.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.0.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "6492cac5c10f9fa8443ceddd2191a7b65b73f601"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.13.0
3.13.1
3.14.0
3.14.1
3.14.2
3.14.3
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.17.5
3.17.6
3.17.7
3.18.0
3.18.1
3.18.2
3.19.0
3.19.1
3.19.2
3.19.3
3.2.0
3.20.0
3.21.0
3.21.1
3.22.0
3.22.1
3.22.2
3.22.3
3.22.4
3.22.5
3.23.0
3.23.1
3.24.0
3.25.0
3.25.1
3.25.2
3.25.3
3.25.4
3.25.5
3.25.6
3.26.0
3.26.1
3.26.2
3.26.3
3.26.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.10
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-51017.json"