CVE-2022-51008

MediumCVSS 5.3/10Last modified Sep 8, 2026

Description

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-510097.5PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. AttacCVE-2022-510106.5PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send craftCVE-2022-510114.3PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, aCVE-2022-510126.5PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clCVE-2022-510136.5PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. AttackersCVE-2022-510146.5PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSCVE-2022-510156.5PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTranCVE-2022-510166.1PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting clCVE-2022-510177.5PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped valueCVE-2022-510186.5PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obCVE-2022-510198.8Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter CVE-2022-510205.9Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cooki
CVE-2022-51008: Medium severity, CVSS 5.3 | Vulnix