{"id":"GHSA-wjfq-88q2-r34j","summary":"Unhandled exception when decoding form response JSON","details":"### Impact\nWhen handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.\n\nAn `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.\n\n### Patches\n56fe71d939c38fe14e18a31a673a9331bcc0e4ca\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.\n\nNote that this requires copying the body of the function to a plugin, since the function is currently private.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","aliases":["CVE-2022-51014"],"modified":"2026-09-08T03:55:57.103058068Z","published":"2022-01-21T23:02:14Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-01-21T21:16:09Z"},"references":[{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/blob/4.0.7/changelogs/4.0.md#407"}],"affected":[{"package":{"name":"pocketmine/pocketmine-mp","ecosystem":"Packagist","purl":"pkg:composer/pocketmine/pocketmine-mp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-wjfq-88q2-r34j/GHSA-wjfq-88q2-r34j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}