Is CVE-2022-51017 being exploited?

No public exploit is currently tracked.

How severe is CVE-2022-51017?

CVE-2022-51017 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2022-51017

Description

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.