CVE-2022-51009 affects PocketMine-MP versions before 4.7.2, where improper exception handling in the adhocore/json-comment library leads to a denial-of-service vulnerability. Attackers can exploit this by sending malformed login or skin packets containing invalid JSON geometry data. This triggers an unhandled RuntimeException that causes the game server to crash. The vulnerability requires no authentication, making it trivially exploitable by any network-reachable attacker. The fix was introduced in PocketMine-MP version 4.7.2. A patch commit is available on GitHub along with a published security advisory. The issue highlights risks associated with insufficient input validation and exception handling in third-party library integrations. Server operators are advised to upgrade immediately to mitigate the risk of targeted denial-of-service attacks.
