PocketMine-MP versions before 5.25.2 allow an attacker to send packets containing an excessive number of delimiters, causing the server to call the explode() function without limits. This produces high CPU and memory consumption during sign editing, JWT parsing, and command parsing, ultimately leading to a service disruption. The weakness is classified as *CWE‑400 Uncontrolled Resource Consumption* and manifests as a denial of service.

The vulnerability affects all PocketMine‑MP installations running a version earlier than 5.25.2. No additional version qualifiers are listed, so any build prior to that release is potentially impacted.

The CVSS score of 6.9 indicates a medium severity risk; the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by connecting to the PocketMine‑MP server over the network and sending specially crafted packets, so the vector is inferred to be remote network traffic. No public exploit code has been reported, but the lack of input validation makes the vector straightforward for automated attacks that trigger resource exhaustion.