CVE-2022-51018

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 3.26.5 PocketMine-MP versions 4.0.x prior to 4.0.5

Description The software fails to limit the length of book page text, the total page count, or the length of the author and title fields. An attacker with a writable book can create oversized NBT (Named Binary Tag) data, known as book bombs. This leads to excessive bandwidth consumption and server crashes. In version 3, crashes occur when saving region-based worlds due to exceeding the 1 MB chunk size limit. In version 4, crashes occur if any book page exceeds the 32 KiB TAG String size limit.

Recommendations Update to version 3.26.5. Update to version 4.0.5. Ban writable books. Use a plugin to cancel the PlayerEditBookEvent if strlen(text) > 1024 or mb strlen(text) > 256.