The vulnerability arises because PocketMine‑MP before 3.26.5 (and 4.0.x before 4.0.5) fails to impose limits on the length of book page text, number of pages, or the size of the author and title fields. A player who can write a book can therefore create a malformed NBT structure—called a “book bomb”—that can overflow the internal limits. When the server tries to process, save or transmit such a book, it consumes excessive bandwidth, or exceeds the 1 MB chunk size limit in region‑based worlds on PM3 or the 32 KiB TAG_String limit in PM4, leading to a crash. This translates to a denial of service for all players connected to the server and can be used to degrade the availability of the service in a shared environment.

The flaw is present in PocketMine‑MP version 3.x prior to 3.26.5 and in the 4.0.x line before 4.0.5. Operators running either of these releases must verify which branch they are on, as the issue is tied to the NBT handling in both major versions.

The CVSS base score of 7.1 reflects a moderate to high severity. The exploit is straightforward once the attacker can write a book; it only requires a small amount of data and does not require any privileged actions beyond normal player rights. Because the vulnerability is not listed in the CISA KEV catalog and no public exploitation reports have emerged, the immediate risk appears to be limited, but a server that allows unrestricted book editing remains vulnerable to DoS attacks.