CVE-2022-51011

Deferred Deferred - Pending Action

PocketMine-MP Chat Message Length Validation Flaw

Publication date: 2026-09-07

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-10

Generated

2026-09-27

AI Q&A

2026-09-07

EPSS Evaluated

2026-09-26

NVD

CVE-2022-51011

EUVD

EUVD-2022-56040

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	mp	to 4.2.10 (exc)
pocketmine-mp	pocketmine-mp	to 4.2.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2022-51011 is a denial-of-service (DoS) vulnerability in PocketMine-MP, a Minecraft server software. It occurs when the server fails to validate the total length of incoming chat messages before splitting them by newline characters. Attackers exploit this by sending large messages with many newlines, causing the server to process excessive message parts and become unresponsive.

Detection Guidance

Monitor PocketMine-MP server logs for unusually large chat messages or excessive newline characters. Check for server lockups or high CPU usage during chat interactions. Use network monitoring tools to detect large or frequent chat packets from clients.

Impact Analysis

This vulnerability can cause server lockups lasting seconds or minutes, degrading performance or crashing the server. It may disrupt gameplay for users and require server restarts to recover. Attackers can exploit it to flood servers with thousands of malicious messages.

Compliance Impact

This vulnerability primarily impacts availability by causing server lockups through excessive resource consumption, which could lead to temporary service disruptions. It does not directly affect confidentiality or integrity of data. Compliance standards like GDPR and HIPAA focus on data protection, availability, and integrity; while this issue threatens availability, it does not inherently violate these standards unless service disruptions result in unauthorized data access or prolonged downtime affecting regulated operations.

Mitigation Strategies

Upgrade PocketMine-MP to version 4.2.10 or later to apply the official patch. Implement rate limiting for chat messages to prevent flooding. Monitor server performance and block clients sending excessively large messages.

Hi! I’m here to help you understand CVE-2022-51011. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70