Iniciar sesión
Deutsch English Español Polski
Media

Book page text, count, and author/title length is not limited in PocketMine-MP

  • Publicada: 06.01.2022
  • Actualizado: 11.10.2026 10:22

Impact

Players can fill book pages with as many characters as they like; the server does not check this. In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:

  • Oversized NBT on the wire costing excess bandwidth for server and client
  • Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
  • Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

Patches

The bug has been fixed in 3.26.5 and 4.0.5.

Workarounds

Ban writable books, or use a plugin to cancel PlayerEditBookEvent to cancel the event if strlen(text) > 1024 || mb_strlen(text) > 256.

For more information

If you have any questions or comments about this advisory:

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer pocketmine/pocketmine-mp < 3.26.5, >= 4.0.0, < 4.0.5 3.26.5, 4.0.5

Referencias

Puntuación CVSS 6.5/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE)
-
Plataforma
Composer
Paquete
pocketmine/pocketmine-mp
Publicada
06.01.2022
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-p62j-hrxm-xcxf - CC BY 4.0

Historial de vulnerabilidades: pocketmine/pocketmine-mp

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (30) en el archivo
Entradas en total
30
Primera → última
11.2020 04.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Alta 20
  • Media 8
  • Baja 2

Divulgaciones por año

Gravedad:
  1. PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling
    Alta CVE-2026-86204 < 5.39.2 5.39.2
  2. PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket
    Alta · 7.5 CVE-2026-86201 < 5.41.1 5.41.1
  3. PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking
    Alta CVE-2025-71417 < 5.32.1 5.32.1
  4. PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)
    Alta · 7.5 CVE-2024-58381 < 5.11.1 5.11.1
  5. PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid
    Alta · 7.5 CVE-2024-58380 < 5.11.2 5.11.2
  6. PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)
    Alta · 7.5 CVE-2023-54390 >= 5.0.0, < 5.3.1, < 4.23.1 5.3.1, 4.23.1
  7. PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey
    Alta · 7.5 CVE-2023-54355 >= 5.2.0, < 5.3.1 5.3.1
  8. PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket
    Alta · 7.5 CVE-2023-54392 >= 4.20.0, < 4.22.3, >= 5.0.0, < 5.2.1 4.22.3, 5.2.1
  9. PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash
    Alta · 7.5 CVE-2023-7332 < 4.18.1 4.18.1
  10. PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency
    Alta · 7.5 CVE-2023-54393 < 4.20.5, >= 4.21.0, < 4.21.1 4.20.5, 4.21.1
  11. PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash
    Alta · 7.5 CVE-2023-54396 < 4.8.1 4.8.1
  12. PocketMine-MP invalid skin geometry JSON data leading to server crash
    Alta · 7.5 CVE-2022-51009 < 4.7.2 4.7.2
  13. Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP
    Alta · 7.5 CVE-2022-51010 >= 4.0.0-BETA5, < 4.4.2 4.4.2
  14. Insufficient type validation in pocketmine/pocketmine-mp
    Alta · 7.5 CVE-2022-51012 < 4.2.9 4.2.9
  15. Improperly checked metadata on tools/armour itemstacks received from the client
    Alta · 7.5 CVE-2022-51013 < 4.2.4 4.2.4
  16. NaN/INF in serverbound movement packets can crash clients and servers
    Alta · 7.5 CVE-2021-48007 < 3.18.1 3.18.1
  17. Unhandled exception when decoding form response JSON
    Alta · 7.5 CVE-2022-51014 >= 4.0.0, < 4.0.7 4.0.7
  18. Unchecked validity of Facing values in PlayerActionPacket
    Alta · 7.5 CVE-2022-51015 < 4.0.6 4.0.6
  19. Uncapped length of skin data fields submitted by players
    Alta · 7.5 CVE-2022-51017 < 3.26.5, >= 4.0.0, < 4.0.5 3.26.5, 4.0.5
  20. Book page text, count, and author/title length is not limited in PocketMine-MP esta entrada
    Media · 6.5 CVE-2022-51018 < 3.26.5, >= 4.0.0, < 4.0.5 3.26.5, 4.0.5
Mostrar más (1) Mostrando 20 de 21

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.