elseadmin/geyser-dos-poc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
GeyserMC Bedrock DoS PoC + write-up (resource-pack flood and NBT allocation)
1 commit 1 branch 0 tags 166 KiB
  • Go 46.9%
  • Java 41%
  • Shell 12.1%
Find a file
Exact
poc 1f6791a59b Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target
2026-09-19 20:56:27 +02:00
docs Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target 2026-09-19 20:56:27 +02:00
fuzzer Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target 2026-09-19 20:56:27 +02:00
harness Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target 2026-09-19 20:56:27 +02:00
poc Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target 2026-09-19 20:56:27 +02:00
README.md Round 2: patches (D1/D2/R1/R2), new findings (G1-G6/R1-R5), NBT LIST fuzz target 2026-09-19 20:56:27 +02:00

README.md

GeyserMC DoS PoC + bug hunt

Proof-of-concept, patches, and write-up for denial-of-service bugs in GeyserMC (Bedrock -> Java bridge).

Tested revision: Geyser 2.11.3-SNAPSHOT, git 2808f7d2, Bedrock protocol 2193 (26.51).

Only run this against servers you own or are authorized to test.

Findings

ID Primitive Kind Fixed by
D1 packsToSend unbounded growth (resource-pack flood) persistent; OOMs any heap patch P1
D2 serverbound NBT used EncodingSettings.DEFAULT (512 MiB) transient patch P3 (partial)
G1 NBT LIST count uncapped (~50x amplification) transient P3 bounds it
G2 item NBT hits the arraySize*4 overflow transient needs upstream NBT fix
R1 chunkRequestQueue unbounded persistent patch P2
R2 chunkIndex * CHUNK_SIZE overflow wedges the queue persistent patch P2

Still unfixed: Cloudburst NBT arraySize*N 32-bit overflow (proposed upstream patch in docs/patches/cloudburst-nbt-proposed.patch).

Layout

poc/        Go PoC (raw Bedrock client + pre-auth NBT payloads)
fuzzer/     Jazzer harness (NBT, packet decode, batch, NBT LIST)
harness/    Automated local Geyser test matrix
docs/       Reports, bug-hunt results, patches

See docs/geyser-exploits-explained.md and docs/geyser-bug-hunt-round2.md.