{"id":"GHSA-wjfq-88q2-r34j","aliases":["CVE-2022-51014"],"title":"Unhandled exception when decoding form response JSON","description":"### Impact\nWhen handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.\n\nAn `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.\n\n### Patches\n56fe71d939c38fe14e18a31a673a9331bcc0e4ca\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.\n\nNote that this requires copying the body of the function to a plugin, since the function is currently private.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","severity":"high","score":7.5,"published":"2022-01-21T23:02:14.000Z","modified":"2026-09-08T12:38:31.849Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","ranges":[{"events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}],"type":"ECOSYSTEM"}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6"],"fixed":["4.0.7"]}],"references":["https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j","https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca","https://github.com/pmmp/PocketMine-MP","https://github.com/pmmp/PocketMine-MP/blob/4.0.7/changelogs/4.0.md#407"],"sources":[{"name":"OSV","id":"GHSA-wjfq-88q2-r34j","modified":"2026-09-08T12:38:31.849447888Z","url":"https://osv.dev/vulnerability/GHSA-wjfq-88q2-r34j"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}]}