{"items":[{"id":"NVI-00002261","kind":"vulnerability","title":"Denial-of-service vulnerability processing large chat messages containing many newlines","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gj94-v4p9-w672","CVE-2022-51011"],"plain_summary":"OSV carries this publisher advisory for pocketmine/pocketmine-mp. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 4.2.10 for pocketmine/pocketmine-mp. Confirm the publisher’s latest guidance.","source_ids":["sr-1178c87ed2f6b9183359cfb0acdc7329"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6f4c48fda2efc8ac9e62cd0b921927bb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.451%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.39193. Missing scores are unknown.","source_id":"sr-6f4c48fda2efc8ac9e62cd0b921927bb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1178c87ed2f6b9183359cfb0acdc7329","url":"https://github.com/advisories/GHSA-gj94-v4p9-w672","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-gj94-v4p9-w672","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.418Z"},{"id":"sr-6f4c48fda2efc8ac9e62cd0b921927bb","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2022-51011","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1178c87ed2f6b9183359cfb0acdc7329"],"technology":"pocketmine/pocketmine-mp","known_exclusions":[],"conditions_summary":"### Impact\nPocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by `\\n`, and each part is treated as a separate message, the length of each part is individually checked. The length of the whole message is not checked.\n\nThis leads to an exploitable performance issue, in which a malicious client may send a chat packet of several megabytes containing nothing but `\\n` newline characters. The server will parse this into a very large array and spend a long time (several milliseconds) iterating over it for no reason.\n\nFurthermore, due to the lack of sufficient rate limit checks before parsing messages, malicious clients may bombard the server with many thousands of these malicious messages, causing lockups for a significant amount of time (seconds or minutes).\n\n### Patches\nThis bug was addressed in https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258 by:\n- checking the length of the incoming message as a whole before parsing it - it may not be larger than `messageCounter * maxChatMessageSize` (`m","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.2.10"]}],"null_published_at":"2026-11-01T19:14:01.581Z","source_updated_at":"2026-09-08T12:38:14.319Z","source_disclosed_at":"2022-05-25T22:34:01.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.418Z"},{"id":"NVI-00002261","kind":"vulnerability","title":"Denial-of-service vulnerability processing large chat messages containing many newlines","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gj94-v4p9-w672","CVE-2022-51011"],"plain_summary":"OSV carries this publisher advisory for pocketmine/pocketmine-mp. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 4.2.10 for pocketmine/pocketmine-mp. Confirm the publisher’s latest guidance.","source_ids":["sr-1178c87ed2f6b9183359cfb0acdc7329"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1178c87ed2f6b9183359cfb0acdc7329","url":"https://github.com/advisories/GHSA-gj94-v4p9-w672","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-gj94-v4p9-w672","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.418Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1178c87ed2f6b9183359cfb0acdc7329"],"technology":"pocketmine/pocketmine-mp","known_exclusions":[],"conditions_summary":"### Impact\nPocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by `\\n`, and each part is treated as a separate message, the length of each part is individually checked. The length of the whole message is not checked.\n\nThis leads to an exploitable performance issue, in which a malicious client may send a chat packet of several megabytes containing nothing but `\\n` newline characters. The server will parse this into a very large array and spend a long time (several milliseconds) iterating over it for no reason.\n\nFurthermore, due to the lack of sufficient rate limit checks before parsing messages, malicious clients may bombard the server with many thousands of these malicious messages, causing lockups for a significant amount of time (seconds or minutes).\n\n### Patches\nThis bug was addressed in https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258 by:\n- checking the length of the incoming message as a whole before parsing it - it may not be larger than `messageCounter * maxChatMessageSize` (`m","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.2.10"]}],"null_published_at":"2026-10-31T21:54:04.903Z","source_updated_at":"2026-09-08T12:38:14.319Z","source_disclosed_at":"2022-05-25T22:34:01.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.418Z"}],"next_cursor":null,"snapshot_revision":"42594"}