CVE-2022-51008

Medium

Description

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.

SeverityMedium

CVSS5.3

Exploit probability—

ProductPocketMine-MP

PublishedSep 6, 2026

First seenSep 6, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Update

pmmp PocketMine-MP4.12.3 or later

Patches

github.com/pmmp/PocketMine-MP/commit/59be901efe6b7833e69e638e0e1497051ce96fa7

Vendor advisories

github.com/pmmp/PocketMine-MP/security/advisories/GHSA-474q-9hgp-hcvx

Affected products

Product	Affected versions	Fixed in
pmmp PocketMine-MP	4.0.0 ≤ v < 4.12.3	4.12.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.