Description (CNA)
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pmmp / PocketMine-MP | affected 0 before 4.23.1; affected 5.0.0 before 5.3.1 |
CWE
CWE-1025
References
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
- https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
- https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket
ADP enrichment
No English description supplied.
No references supplied.