CrashExploitFixer

KO | EN

gitlite — search

#react #ai #typescript #llm #rust #deep-learning #java #windows #awesome #kubernetes #awesome-list #vue #ios #open-source

CrashExploitFixer

(★ 10)

This mod fixes a bunch of crash exploits discovered in Minecraft.

CrashExploitFixer Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CrashExploitFixer
The mod currently patches three different exploits for all affected Minecraft versions from 1.14.4 to Latest!

## Entity Selector NBT Stack Overflow
A stack overflow vulnerability in Minecraft versions 1.14.4 through the latest release at the time of writing allows 
attackers to crash servers by abusing deeply nested NBT data inside entity selectors, causing recursive parsing in 
`TagParser` to exhaust the JVM stack. While Minecraft 1.21.1 prevents unprivileged players from triggering the 
issue through entity selectors, operators and creative-mode players can still reproduce the crash on unpatched servers.
Notably, PaperMC discovered and [patched](https://github.com/PaperMC/Paper/blob/df3b6544f74be73c8882b97c43d39022340f2d74/patches/server/0951-Improve-tag-parser-handling.patch) the underlying parser issue months earlier.

Blogpost from haykam: [haykam.com](https://web.archive.org/web/20250924134748/https://haykam.com/blog/entity-selector-stack-overflow-crash)

## Excessive Network Object Allocation
A denial-of-service vulnerability affecting Minecraft networking allowed authenticated players to crash servers by 
sending malicious packets that triggered excessive memory allocation during collection deserialization through 
`FriendlyByteBuf.readCollection`, `FriendlyByteBuf.readMap`, or related methods. While the issue was exploitable 
through a Fabric API packet and likely many modded packets across different loaders, NeoForge and Fabric patched the 
issue for their most active versions (NeoForge: 1.21.1 and 26.1, Fabric: 1.20.1, 1.21.1, 1.21.11, 26.1, 26.2). 
CrashExploitFixer patches the issue for all versions of Forge, NeoForge, and Fabric and is compatible with their fixes.

Many thanks to [Paul](https://github.com/pau101) for reporting this in private

Blogpost from NeoForge: [neoforged.net](https://neoforged.net/news/mitigating-vulnerabilities-network/)

## Translatable Component Expansion
A denial-of-service vulnerability affecting Minecraft 1.16 through 1.21.4 allowed attackers to craft recursively 
expanding text components that could inflate into enormous strings during parsing, flattening, or calls such as 
`Component#getString()`, leading to severe memory exhaustion and client or server soft-crashes. Newer research showed 
that specially constructed hover-event payloads could trigger the issue without elevated permissions in vanilla 
1.20.5–1.21.4. PaperMC had already [protected against](https://github.com/PaperMC/Paper/blob/8dea6f1761c97da76fa2e42c6f74fb1242c23feb/paper-server/patches/sources/net/minecraft/network/chat/contents/TranslatableContents.java.patch) 
this class of exploit for years, while modded environments remain especially vulnerable due to widespread use of 
`FriendlyByteBuf#readComponent()` and related component deserialization paths in network packets.

Many thanks to [Paul](https://github.com/pau101) for reporting this in private

CrashExploitFixer

CrashExploitFixer Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

CrashExploitFixer

CrashExploitFixer Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README