Medium severity5.3NVD Advisory· Published Sep 9, 2026· Updated Oct 14, 2026

CVE-2025-71418

Description

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pmmp/Pocketmine Mpreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <5.25.2

Patches

Vulnerability mechanics

References

github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831nvd
github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78pnvd
www.vulncheck.com/advisories/pocketmine-mp-before-5.25.2-denial-of-service-via-explodenvd

News mentions

PocketMine-MP: 18 DoS Vulnerabilities Disclosed in Coordinated Batch
Vypr Intelligence · Sep 9, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000