Protect your modded Minecraft server from BleedingPipe

BleedingPipe is a flaw in certain Forge mods that lets a stranger run code on your server. The MMPA says that can spread to players who join, though it does not know of any such malware in the wild. The flaw is in the mods, not in Forge itself, so the fix is to update or remove them, add a filter and check your files. The steps below apply to a modded Minecraft server on our panel.

Checked against the Minecraft Malware Prevention Alliance (MMPA) BleedingPipe advisory and PipeBlocker 1.2.0, October 2026.

What it is and who it affects

The MMPA describes BleedingPipe as a remote code execution exploit, used in the wild, that targets mods using unsafe deserialisation code. The affected mods used Java's ObjectInputStream for their network traffic, so a crafted packet can make the server run whatever the attacker sends. Many Forge 1.7.10 and 1.12.2 modpacks are vulnerable, but any Minecraft version can be affected if an affected mod is installed.

The MMPA's list of known affected mods, which it says is not complete, includes:

• EnderCore, a dependency of EnderIO
• LogisticsPipes, fixed in version 0.10.0.71
• BDLib 1.7 to 1.12
• Smart Moving 1.12, Brazier, DankNull and Gadomancy

See what your server runs

1. Open the Mods tab and switch the view to Installed.
2. Compare the names with the list above.
3. On a modpack server, also open File Manager and look inside the mods folder to see every mod, including ones a pack installed.

Update the mods

1. Open the Backups tab and press Create backup. Updating every mod can break a ready-made modpack, as the MMPA warns.
2. In Mods, Installed, press Check for updates. If it finds newer builds the button becomes Update all, with a count.
3. Restart the server so the new jars load.

For a mod the panel cannot match to a source, download the current version from its own page and upload it to the mods folder through File Manager, or over SFTP for files above 100 MB. Manage your server files covers both.

Add PipeBlocker

The MMPA publishes a mod called PipeBlocker that filters ObjectInputStream traffic, so it protects against affected mods you do not know about. Its Modrinth page lists Forge builds for Minecraft 1.7.2 to 1.12.2 and Fabric builds up to 1.20.1.

1. Open Mods and the Store view.
2. In the source chip row at the top of the tab, pick Modrinth, then search for PipeBlocker.
3. Press Install and restart the server.

The MMPA recommends it on both servers and clients, so ask your players to install it too. If your server runs a version PipeBlocker has no build for, updating the affected mods matters even more.

Scan the files

The MMPA suggests scanning every installed mod with a tool such as jNeedle, because malware aimed at servers tends to infect other mods once it is in.

1. In File Manager, use Download on the mods folder. The panel packs the folder into one zip for you.
2. Unzip it on your own computer and run jNeedle against the folder, for example java -jar jneedle-cli-1.1.0-local-all.jar -f <path to the folder>, or use its graphical version, jneedle-gui-1.1.0-local-all.jar. Both are on the jNeedle releases page, and the file names change with each release.
3. Remove or replace anything it flags, then ask players who joined while a vulnerable mod was installed to scan their own computers.