Technical impact
The vulnerability lies in the way PocketMine-MP processes LoginPacket JSON data. Because the JsonMapper dependency performs insufficient input validation, an attacker can craft a malformed JSON structure within a LoginPacket and send it to the server. When the server attempts to parse this packet, it crashes, resulting in a denial of service. This flaw primarily undermines the availability of the server, as legitimate connections become impossible while the service is down.
Affected Systems
PocketMine-MP (pmmp) versions earlier than 4.20.5 are affected. The issue exists in all releases up to and including 4.20.4, as they rely on a vulnerable JsonMapper implementation. Servers running these versions are susceptible to the described denial of service attack.
Risk and Exploitability
The CVSS score of 8.7 categorizes the flaw as High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation but still high risk due to the nature of the impact. Attackers can exploit the flaw remotely by transmitting a specially crafted LoginPacket over the network; no prior authentication or elevated privileges are required. The attack could be performed from any external source able to reach the server, leading to repeated crashes and availability outages if not mitigated.
