A critical input validation vulnerability in PocketMine-MP allows unauthenticated remote attackers to crash game servers, resulting in a complete denial of service.

This vulnerability is an improper input validation flaw (CWE-20) where the server fails to enforce size limits on skin data fields. An unauthenticated attacker can submit maliciously crafted, oversized data strings that exceed the 32767 byte limit, triggering exceptions during NBT serialization and causing the server process to terminate.

The exploitation of this vulnerability results in a denial of service, which disrupts game availability and impacts the user experience. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to service continuity for server administrators. Frequent crashes may lead to data loss or corruption, depending on the server state at the time of the crash.

Immediate Action: Update PocketMine-MP to version 3.26.5, 4.0.5, or any subsequent patched release.

Proactive Monitoring: Monitor server logs for unexpected process terminations or recurring NBT serialization exceptions.

Compensating Controls: While no direct WAF rule can easily parse NBT serialization, network-level rate limiting may help reduce the frequency of malicious payloads arriving at the server.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the ease of triggering a crash without requiring authentication. Administrators must prioritize updating to the fixed versions to ensure service stability. Failure to patch leaves the server vulnerable to trivial denial-of-service attacks that can be automated by malicious actors.