Medium severity · published Sep 7, 2026
CVE-2022-51011
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PocketMine-MP · pmmp
before 4.2.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-51011
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-51011
vendor-advisory
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672
patch
https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258
third-party-advisory
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.10-denial-of-service-via-chat-messages
More from PocketMine-MP
7.5
CVE-2026-86201
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
7.5
CVE-2026-86199
PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
7.5
CVE-2024-58381
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
7.5
CVE-2023-54393
PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
7.5
CVE-2023-54390
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket