{"id":"CVE-2022-51012","state":"PUBLISHED","title":"PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization","description":"PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.","publishedAt":"2026-09-07T12:55:06.530Z","updatedAt":"2026-10-08T15:20:55.753Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["pmmp PocketMine-MP"],"affected":[{"vendor":"pmmp","product":"PocketMine-MP","packageURL":"pkg:composer/pocketmine/pocketmine-mp","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.2.9","versionType":"semver"},{"version":"4.2.9","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g","https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2","https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/51xxx/CVE-2022-51012.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-51012","state":"PUBLISHED","datePublished":"2026-09-07T12:55:06.530Z","dateUpdated":"2026-10-08T15:20:55.753Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-05T21:02:18.431Z"},"containers":{"cna":{"title":"PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization","descriptions":[{"lang":"en","value":"PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service."}],"affected":[{"vendor":"pmmp","product":"PocketMine-MP","packageURL":"pkg:composer/pocketmine/pocketmine-mp","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.2.9","versionType":"semver"},{"version":"4.2.9","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-g5rr-p69h-7v3g)"},{"url":"https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2","tags":["patch"],"name":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization","name":"VulnCheck Advisory: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"Improper Input Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-08T15:20:55.753Z"},"datePublic":"2022-04-19T00:00:00.000Z","tags":["unsupported-when-assigned"],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-08T12:51:35.267702Z","id":"CVE-2022-51012","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-08T12:51:42.093Z"}}]}}}