CVE-2025-71418
PocketMine-MP before 5.25.2 Denial of Service via explode
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.
| CWE | CWE-400 |
| Vendor | pmmp |
| Product | pocketmine-mp |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for pmmp pocketmine-mp
Be the first to know when new medium vulnerabilities affecting pmmp pocketmine-mp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
pmmp / PocketMine-MP
0 < 5.25.2