Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2022-51015

PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 4.0.6affected
  • 4.0.6unaffected
pkg:composer/pocketmine/pocketmine-mp

References