CVE-2022-51014
Received Received - Intake

PocketMine-MP Unhandled Exception in Form Response Handling

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2022-51014
EUVD
EUVD-2022-56043

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pocketmine pocketmine-mp to 4.0.7 (exc)
pocketmine mp to 4.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PocketMine-MP before version 4.0.7 has an unhandled exception vulnerability in the ModalFormResponsePacket handler. When clients send malformed JSON in form response packets, the server's JSON decoder fails to parse it. The server attempts to fix the JSON but throws an uncaught InvalidArgumentException if it cannot, causing the server to crash.

Detection Guidance

Monitor PocketMine-MP server logs for crashes or exceptions related to JSON decoding in ModalFormResponsePacket handling. Check for InvalidArgumentException errors when processing form responses. Use network monitoring tools to detect malformed JSON packets sent to the server.

Impact Analysis

This vulnerability allows attackers to crash PocketMine-MP servers by sending specially crafted form response packets with invalid JSON. This results in a Denial of Service (DoS) where the server becomes unavailable until manually restarted. Servers running versions prior to 4.0.7 are affected.

Compliance Impact

This vulnerability primarily causes server crashes due to unhandled exceptions from malformed JSON, leading to denial-of-service conditions. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, prolonged downtime from repeated attacks could disrupt services handling sensitive data, potentially affecting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade PocketMine-MP to version 4.0.7 or later to apply the official patch. If immediate upgrade is not possible, implement a plugin to catch ModalFormResponsePacket exceptions or use the stupid_json_decode() workaround function for JSON processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart