PT-2026-86776 · Pmmp+2 · Pocketmine-Mp+1

CVE-2022-51014

·

Published

2022-01-21

·

Updated

2026-09-07

CVSS v4.0
CVSS v3.1

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

When handling form responses from the client (ModalFormResponsePacket), the Minecraft Windows client may send weird JSON that json decode() can't understand. A workaround for this is implemented in InGamePacketHandler::stupid json decode().
An InvalidArgumentException is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.

Patches

56fe71d939c38fe14e18a31a673a9331bcc0e4ca

Workarounds

A plugin may handle DataPacketReceiveEvent, capture ModalFormResponsePacket and run the provided JSON through stupid json decode.
Note that this requires copying the body of the function to a plugin, since the function is currently private.

For more information

If you have any questions or comments about this advisory:

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2022-51014
GHSA-WJFQ-88Q2-R34J

Affected Products

Pocketmine-Mp
Pocketmine/Pocketmine-Mp