CVE-2022-51008
Received Received - Intake

PocketMine-MP Session Flooding Vulnerability

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulnCheck

Description
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2022-51008
EUVD
EUVD-2022-56035

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pocketmine pocketmine-mp to 4.12.3 (exc)
pocketmine-mp pocketmine-mp to 4.12.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2022-51008 is a Denial of Service (DoS) vulnerability in PocketMine-MP versions before 4.12.3. It allows attackers to create unauthenticated sessions that occupy player slots without completing login, preventing legitimate players from joining the server.

Detection Guidance

Monitor for unusually high numbers of active connections without completed login packets. Check server logs for repeated connection attempts that do not progress to authentication. Use network monitoring tools to track session counts exceeding the configured player limit without corresponding login activity.

Impact Analysis

This vulnerability can cause server downtime by blocking all player slots with fake connections. Legitimate players cannot join, disrupting normal server operations and gameplay.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by allowing unauthenticated sessions to occupy player slots, blocking legitimate users. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR or HIPAA. However, prolonged service disruption could indirectly affect compliance by failing to provide timely access to systems or data, potentially violating availability requirements in these standards.

Mitigation Strategies

Upgrade PocketMine-MP to version 4.12.3 or later to apply the official patch. If immediate upgrade is not possible, temporarily increase the max player count as a stopgap measure, though this is not a permanent solution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart