CyberRota Analysis
AI-GeneratedPocketMine-MP versions prior to 3.26.5 and 4.0.x before 4.0.5 are vulnerable due to a lack of restrictions on writable book attributes, allowing players to create oversized NBT data, known as 'book bombs.' This can lead to excessive bandwidth consumption and potential server crashes by exceeding the size limits for saving region-based worlds. Server administrators and developers using affected versions should prioritize applying the latest updates to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).