CVE-2025-71418

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71418
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71418.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71418
Aliases
Published
2026-09-09T13:31:57Z
Modified
2026-09-11T03:48:20Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
PocketMine-MP before 5.25.2 Denial of Service via explode
Details

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71418.json"
}
References

Affected packages

Git / github.com/pmmp/pocketmine-mp

Affected ranges

Type
GIT
Repo
https://github.com/pmmp/pocketmine-mp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8824a36b95b8a27927faa1b8d1ac4c6f3487649
Fixed
d0d84d4c5195fb0a68ea7725424fda63b85cd831
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.25.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4
1.4-916
1.4.1
1.4.1dev-936
1.6.1dev-87
1.6.2dev-229
1.6dev
1.7dev-501
1.7dev-677
1.7dev-83
1.7dev-937
3.*
3.0.0
3.0.1
3.0.2
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.13.0
3.13.1
3.14.0
3.14.1
3.14.2
3.14.3
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.17.5
3.17.6
3.17.7
3.18.0
3.18.1
3.18.2
3.19.0
3.19.1
3.19.2
3.19.3
3.2.0
3.20.0
3.21.0
3.21.1
3.22.0
3.22.1
3.22.2
3.22.3
3.22.4
3.22.5
3.23.0
3.23.1
3.24.0
3.25.0
3.25.1
3.25.2
3.25.3
3.25.4
3.25.5
3.25.6
3.26.0
3.26.1
3.4.0
3.4.1
3.5.0
3.5.1
3.5.10
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
4.*
4.0.0
4.1.0-BETA1
4.1.0-BETA2
4.10.0
4.10.1
4.10.2
4.12.0
4.12.1
4.12.10
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.12.8
4.12.9
4.13.0
4.14.0
4.14.1
4.15.0
4.15.1
4.15.2
4.15.3
4.16.0
4.18.0
4.18.0-ALPHA1
4.18.0-ALPHA2
4.19.0
4.19.1
4.19.2
4.19.3
4.20.0
4.20.1
4.20.2
4.20.3
4.20.4
4.21.0
4.21.1
4.4.0
4.4.0-BETA1
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.1
4.9.0
4.9.1
5.*
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.1.3
5.10.0
5.11.0
5.11.1
5.11.2
5.12.0
5.12.1
5.13.0
5.14.0
5.14.1
5.15.0
5.16.0
5.2.0
5.2.1
5.20.0
5.20.1
5.21.0
5.21.1
5.21.2
5.22.0
5.23.0
5.23.1
5.23.2
5.23.3
5.24.0
5.25.0
5.25.1
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.6.0
5.6.1
5.7.0
5.7.1
5.8.1
5.8.2
5.9.0
Alpha_1.*
Alpha_1.0
Alpha_1.0.1
Alpha_1.0.2
Alpha_1.0.3
Alpha_1.0.4
Alpha_1.0.5
Alpha_1.0.6
Alpha_1.0.7
Alpha_1.0.8
Alpha_1.1
Alpha_1.1.1
Alpha_1.2
Alpha_1.2.1
Alpha_1.3
Alpha_1.3.1
Alpha_1.3.10
Alpha_1.3.2
Alpha_1.3.3
Alpha_1.3.4
Alpha_1.3.5
Alpha_1.3.7
Alpha_1.3.8
Alpha_1.3.9
Alpha_1.4dev-228
Alpha_1.4dev-277
Alpha_1.4dev-413
Alpha_1.4dev-449
Alpha_1.4dev-478
Alpha_1.4dev-491
Alpha_1.4dev-576
Alpha_1.4dev-599
Alpha_1.4dev-659
Alpha_1.4dev-665
Alpha_1.4dev-707
Alpha_1.4dev-834
Alpha_1.4dev-842
Alpha_1.4dev-847
Alpha_1.4dev-855
Alpha_1.4dev-900
api/1.*
api/1.11.0
api/2.*
api/2.0.0
api/2.1.0
api/3.*
api/3.0.0-ALPHA1
api/3.0.0-ALPHA10
api/3.0.0-ALPHA11
api/3.0.0-ALPHA12
api/3.0.0-ALPHA2
api/3.0.0-ALPHA3
api/3.0.0-ALPHA4
api/3.0.0-ALPHA6
api/3.0.0-ALPHA8
Other
pocketmine-mp-rebrand

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71418.json"