SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2022-51017

HIGH · CVSS 7.5 EPSS 0.47% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-07 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

PocketMine-MP versions prior to 3.26.5 and 4.0.5 are vulnerable due to improper validation of skin data field lengths, allowing attackers to submit oversized values that exceed the 32767 byte limit. This can lead to server crashes through exceptions during NBT data serialization, impacting server availability. Server administrators using affected versions should prioritize applying the updates to mitigate this high-severity vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
poc
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2022-51017
Severity
HIGH
CVSS
7.5
EPSS
0.47%

Original NVD Description

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.