CVE-2022-51014CWE-248

CVE-2022-51014

Medium · published September 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-09-07T17:17Z
References (3)
https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.7-denial-of-service-via-json-decoding · [email protected]
EPSS history
Timeline
  • 09 SEP 03:12Z
    EPSS moved — → 1%
    epss
  • 07 SEP 12:55Z
    PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
    cvelistv5