CVE-2022-51012

MEDIUMCVSS 6.5

Description

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

Timeline

Published:September 7th, 2026 1:17 PM

Last modified:September 8th, 2026 7:59 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-20

References & Reports

Advisories, patches, and third-party reports

https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization

Source: NIST NVD · Data may lag official sources by up to one minute