{"id":"CVE-2025-71418","aliases":["GHSA-g274-c6jj-h78p"],"url":"https://o3.security/vulnerability/CVE-2025-71418","summary":"PocketMine-MP before 5.25.2 Denial of Service via explode","details":"### Impact\nDue to lack of limits by default in the [`explode()`](https://www.php.net/manual/en/function.explode.php) function, malicious clients were able to abuse some packets to waste server CPU and memory.\n\nThis is similar to a previous security issue published in https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672, but with a wider impact, including but not limited to:\n\n- Sign editing\n- LoginPacket JWT parsing\n- Command parsing\n\nHowever, the estimated impact of these issues is low, due to other limits such as the packet decompression limit.\n\n### Patches\nThe issue was fixed in 5.25.2 via d0d84d4c5195fb0a68ea7725424fda63b85cd831.\n\nA custom PHPStan rule has also been introduced to the project, which will henceforth require that all calls to `explode()` within the codebase must specify the `limit` parameter.\n\n### Workarounds\nNo simple way to fix this.\nGiven that sign editing is the easiest way this could be exploited, workarounds could include plugins pre-processing `BlockActorDataPacket` to check that the incoming text doesn't have more than 4 parts when split by `\\n`.","published":"2026-09-09T13:31:57.642Z","modified":"2026-10-28T02:30:46.533716800Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"5.25.2"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831","label":"pmmp/PocketMine-MP@d0d84d4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71418.json"},{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g274-c6jj-h78p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71418"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.25.2-denial-of-service-via-explode"},{"type":"FIX","url":"https://github.com/pmmp/PocketMine-MP/commit/d0d84d4c5195fb0a68ea7725424fda63b85cd831"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:46.533716800Z"}}