CrashExploitFixer

# CrashExploitFixer The mod currently patches three different exploits for all affected Minecraft versions from 1. 14. 4 to Latest!

## Entity Selector NBT Stack Overflow A stack overflow vulnerability in Minecraft versions 1. 14. 4 through the latest release at the time of writing allows attackers to crash servers by abusing deeply nested NBT data inside entity selectors, causing recursive parsing in `TagParser` to exhaust the JVM stack. While Minecraft 1. 21. 1 prevents unprivileged players from triggering the issue through entity selectors, operators and creative-mode players can still reproduce the crash on unpatched servers. Notably, PaperMC discovered and (https://github.com/PaperMC/Paper/blob/df3b6544f74be73c8882b97c43d39022340f2d74/patches/server/0951-Improve-tag-parser-handling.patch) the underlying parser issue months earlier.

Blogpost from haykam: (https://web.archive.org/web/20250924134748/https://haykam.com/blog/entity-selector-stack-overflow-crash)

## Excessive Network Object Allocation A denial-of-service vulnerability affecting Minecraft networking allowed authenticated players to crash servers by sending malicious packets that triggered excessive memory allocation during collection deserialization through `FriendlyByteBuf.readCollection`, `FriendlyByteBuf.readMap`, or related methods. While the issue was exploitable through a Fabric API packet and likely many modded packets across different loaders, NeoForge and Fabric patched the issue for their most active versions (NeoForge: 1. 21. 1 and 26. 1, Fabric: 1. 20. 1, 1. 21. 1, 1. 21. 11, 26. 1, 26. 2). CrashExploitFixer patches the issue for all versions of Forge, NeoForge, and Fabric and is compatible with their fixes.

Many thanks to (https://github.com/pau101) for reporting this in private

Blogpost from NeoForge: (https://neoforged.net/news/mitigating-vulnerabilities-network/)

## Translatable Component Expansion A denial-of-service vulnerability affecting Minecraft 1. 16 through 1. 21. 4 allowed attackers to craft recursively expanding text components that could inflate into enormous strings during parsing, flattening, or calls such as `Component#getString()`, leading to severe memory exhaustion and client or server soft-crashes. Newer research showed that specially constructed hover-event payloads could trigger the issue without elevated permissions in vanilla 1. 20. 5–1. 21. 4. PaperMC had already (https://github.com/PaperMC/Paper/blob/8dea6f1761c97da76fa2e42c6f74fb1242c23feb/paper-server/patches/sources/net/minecraft/network/chat/contents/TranslatableContents.java.patch) this class of exploit for years, while modded environments remain especially vulnerable due to widespread use of `FriendlyByteBuf#readComponent()` and related component deserialization paths in network packets.

Many thanks to (https://github.com/pau101) for reporting this in private