{"id":"GHSA-wjfq-88q2-r34j","aliases":[],"url":"https://o3.security/vulnerability/GHSA-wjfq-88q2-r34j","summary":"Unhandled exception when decoding form response JSON","details":"### Impact\nWhen handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.\n\nAn `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.\n\n### Patches\n56fe71d939c38fe14e18a31a673a9331bcc0e4ca\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.\n\nNote that this requires copying the body of the function to a plugin, since the function is currently private.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","published":"2022-01-21T23:02:14Z","modified":"2025-12-26T17:43:38.982935Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"4.0.7"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca","label":"pmmp/PocketMine-MP@56fe71d"},"references":[{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.7/changelogs/4.0.md#407"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-12-26T17:43:38.982935Z"}}