Skip to content

Fix malformed NBT/JSON decode crashes in player list + server data packets#1789

Open
vishv843 wants to merge 1 commit into
PaperMC:dev/3.0.0from
vishv843:fix-vulnerabilities
Open

Fix malformed NBT/JSON decode crashes in player list + server data packets#1789
vishv843 wants to merge 1 commit into
PaperMC:dev/3.0.0from
vishv843:fix-vulnerabilities

Conversation

@vishv843
Copy link
Copy Markdown

@vishv843 vishv843 commented May 8, 2026

Problem
Fuzzing found two reproducible decode-time crashes:

  • NegativeArraySizeException in ProtocolUtils.readBinaryTag(...) (bubbles up from Adventure NBT parsing).
  • JsonSyntaxException/MalformedJsonException in LegacyPlayerListItemPacket.readOptionalComponent(...).
    These exceptions were unhandled and could crash/abort decode paths instead of failing gracefully.

This vulnerability can be exploited by a DoS attack and this fix will improve code robustness

@WouterGritter
Copy link
Copy Markdown
Contributor

WouterGritter commented May 11, 2026

There are a couple issues with this PR:

  • This vulnerability can be exploited by a DoS attack and this fix will improve code robustness

    This path is not exploitable client-side. Both cases where the exceptions are caught are clientbound-only (readBinaryTag() isnt used serverbound). This could only be exploited by a malicious backend server.

  • readBinaryTag() can throw way more than just the NegativeArraySizeException (most obvious example is an index out of bounds in ProtocolUtils#readBinaryTag line 506; BINARY_TAG_TYPES[buf.readByte()])

  • The server won't crash anyways as the uncaught exceptions will be caught upstream (MinecraftDecoder#tryDecode), and kill the connection instead of killing/DOSing the proxy

Fuzzing found two reproducible decode-time crashes

Are you able to share the steps to actually reproduce a full on proxy crash by sending some malformed packets from the client?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants