CVE-2022-51010
PocketMine-MP before 4.4.2 Server Crash via Item ID
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 7, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 5, 2026
Description
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
PocketMine-MPpmmp |
|
References
- GitHub Security Advisory (GHSA-fqx3-r75h-vc89)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: PocketMine-MP before 4.4.2 Server Crash via Item IDthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.