CVE-2022-51010

MEDIUMCVSS 6.5

Description

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

Timeline

Published:September 7th, 2026 1:17 PM

Last modified:September 8th, 2026 7:59 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-20

References & Reports

Advisories, patches, and third-party reports

https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id

Source: NIST NVD · Data may lag official sources by up to one minute