Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
30 vulnerabilities by pmmp
CVE-2022-51018 (GCVE-0-2022-51018)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.26.5 Input Validation via Book Pages
Summary
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT (\u0027book bombs\u0027), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4)."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:10.538Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p62j-hrxm-xcxf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-p62j-hrxm-xcxf"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.26.5 Input Validation via Book Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.26.5-input-validation-via-book-pages"
}
],
"title": "PocketMine-MP before 3.26.5 Input Validation via Book Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51018",
"datePublished": "2026-09-07T12:55:10.538Z",
"dateReserved": "2026-09-05T21:04:08.629Z",
"dateUpdated": "2026-09-07T12:55:10.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51017 (GCVE-0-2022-51017)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
Summary
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/958a… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/6492… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:09.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6fg-99pr-25m9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-c6fg-99pr-25m9"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/6492cac5c10f9fa8443ceddd2191a7b65b73f601"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.26.5-and-4.0.5-denial-of-service-via-skin-data"
}
],
"title": "PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51017",
"datePublished": "2026-09-07T12:55:09.862Z",
"dateReserved": "2026-09-05T21:03:47.627Z",
"dateUpdated": "2026-09-07T12:55:09.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51016 (GCVE-0-2022-51016)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay
Summary
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Severity
6.1 (Medium)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/d28b… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player\u0027s session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:09.180Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h79x-98r2-g6qc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.0-authentication-bypass-via-login-replay"
}
],
"title": "PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51016",
"datePublished": "2026-09-07T12:55:09.180Z",
"dateReserved": "2026-09-05T21:03:26.820Z",
"dateUpdated": "2026-09-07T12:55:09.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51015 (GCVE-0-2022-51015)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
Summary
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/f126… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.6
(semver)
Unaffected: 4.0.6 (semver) |
Date Public
2022-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.6",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:08.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xh99-hw7h-wf63)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.6-denial-of-service-via-playeractionpacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51015",
"datePublished": "2026-09-07T12:55:08.508Z",
"dateReserved": "2026-09-05T21:03:22.919Z",
"dateUpdated": "2026-09-07T12:55:08.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51014 (GCVE-0-2022-51014)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
Summary
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/56fe… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.7
(semver)
Unaffected: 4.0.7 (semver) |
Date Public
2022-01-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.7",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-01-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:07.817Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wjfq-88q2-r34j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.7-denial-of-service-via-json-decoding"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51014",
"datePublished": "2026-09-07T12:55:07.817Z",
"dateReserved": "2026-09-05T21:03:00.814Z",
"dateUpdated": "2026-09-07T12:55:07.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51013 (GCVE-0-2022-51013)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
Summary
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c8e1… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.3
(semver)
Unaffected: 4.2.3 (semver) |
Date Public
2022-03-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "JavierLeon9966"
}
],
"datePublic": "2022-03-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:07.166Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-46c5-pfj8-fv65)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.3-denial-of-service-via-nbt-metadata"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51013",
"datePublished": "2026-09-07T12:55:07.166Z",
"dateReserved": "2026-09-05T21:02:39.792Z",
"dateUpdated": "2026-09-07T12:55:07.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51012 (GCVE-0-2022-51012)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
Summary
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5a98… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.9
(semver)
Unaffected: 4.2.9 (semver) |
Date Public
2022-04-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.9",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:06.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g5rr-p69h-7v3g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51012",
"datePublished": "2026-09-07T12:55:06.530Z",
"dateReserved": "2026-09-05T21:02:18.431Z",
"dateUpdated": "2026-09-07T12:55:06.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51011 (GCVE-0-2022-51011)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
Summary
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.
Severity
4.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/df33… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.10
(semver)
Unaffected: 4.2.10 (semver) |
Date Public
2022-05-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.10",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:05.898Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gj94-v4p9-w672)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.10 Denial of Service via Chat Messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.10-denial-of-service-via-chat-messages"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.10 Denial of Service via Chat Messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51011",
"datePublished": "2026-09-07T12:55:05.898Z",
"dateReserved": "2026-09-05T21:01:56.324Z",
"dateUpdated": "2026-09-07T12:55:05.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51010 (GCVE-0-2022-51010)
Vulnerability from nvd – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.4.2 Server Crash via Item ID
Summary
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5fd6… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.4.2
(semver)
Unaffected: 4.4.2 (semver) |
Date Public
2022-06-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.4.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-06-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:05.273Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fqx3-r75h-vc89)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.4.2 Server Crash via Item ID",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.4.2 Server Crash via Item ID",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51010",
"datePublished": "2026-09-07T12:55:05.273Z",
"dateReserved": "2026-09-05T21:01:35.395Z",
"dateUpdated": "2026-09-07T12:55:05.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51009 (GCVE-0-2022-51009)
Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
Summary
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c962… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.7.2
(semver)
Unaffected: 4.7.2 (semver) |
Date Public
2022-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:18.057Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8cwq-4cmf-px73)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8cwq-4cmf-px73"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c9626c610b8f6810c8c987559c9197b2a291f0bb"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.7.2-denial-of-service-via-skin-geometry"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51009",
"datePublished": "2026-09-06T12:00:24.856Z",
"dateReserved": "2026-09-05T21:01:13.382Z",
"dateUpdated": "2026-09-06T12:50:18.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51008 (GCVE-0-2022-51008)
Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
Summary
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/59be… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
4.0.0 , < 4.12.3
(semver)
Unaffected: 4.12.3 (semver) |
Date Public
2022-12-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.12.3",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.12.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "alvin0319"
}
],
"datePublic": "2022-12-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:17.386Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-474q-9hgp-hcvx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-474q-9hgp-hcvx"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/59be901efe6b7833e69e638e0e1497051ce96fa7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.3-denial-of-service-via-unauthenticated-sessions"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51008",
"datePublished": "2026-09-06T12:00:24.186Z",
"dateReserved": "2026-09-05T21:00:28.837Z",
"dateUpdated": "2026-09-06T12:50:17.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-48007 (GCVE-0-2021-48007)
Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
Summary
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/fb20… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 3.18.1
(semver)
Unaffected: 3.18.1 (semver) |
Date Public
2021-05-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "3.18.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.18.1",
"versionType": "semver"
}
]
}
],
"datePublic": "2021-05-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:16.713Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fm35-jgg3-3grx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.18.1-denial-of-service-via-moveplayerpacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-48007",
"datePublished": "2026-09-06T12:00:23.482Z",
"dateReserved": "2026-09-05T21:04:52.479Z",
"dateUpdated": "2026-09-06T12:50:16.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-48006 (GCVE-0-2021-48006)
Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
Summary
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Severity
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/4d37… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.3
(semver)
Unaffected: 4.0.3 (semver) |
Date Public
2021-12-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2021-12-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:16.053Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j5qg-w9jg-3wg3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.3-operator-privilege-escalation-via-case-sensitivity"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-48006",
"datePublished": "2026-09-06T12:00:22.800Z",
"dateReserved": "2026-09-05T21:04:30.475Z",
"dateUpdated": "2026-09-06T12:50:16.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-37277 (GCVE-0-2020-37277)
Vulnerability from nvd – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
Summary
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c368… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 3.15.4
(semver)
Unaffected: 3.15.4 (semver) |
Date Public
2020-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "3.15.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.15.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "Muqsit"
},
{
"lang": "en",
"type": "analyst",
"value": "CortexPE"
}
],
"datePublic": "2020-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component\u0027s findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:15.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8jq6-w5cg-wm45)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c368ebb5e74632bc622534b37cd1447b97281e20"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.15.4-denial-of-service-via-inventorytransaction"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37277",
"datePublished": "2026-09-06T12:00:22.145Z",
"dateReserved": "2026-09-05T21:05:13.270Z",
"dateUpdated": "2026-09-06T12:50:15.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-7332 (GCVE-0-2023-7332)
Vulnerability from nvd – Published: 2025-12-31 21:37 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash
Summary
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-02 14:17 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/blob/4.18.1… | release-notespatch |
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5897476 | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.18.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:17:28.604553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:35:36.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pmmp/PocketMine-MP",
"product": "PocketMine-MP",
"repo": "https://github.com/pmmp/PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.18.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player\u0027s hotbar, triggering a server crash and resulting in denial of service."
}
],
"value": "PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player\u0027s hotbar, triggering a server crash and resulting in denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:58.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5897476"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "PocketMine-MP \u003c 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-7332",
"datePublished": "2025-12-31T21:37:38.838Z",
"dateReserved": "2025-12-31T20:56:56.399Z",
"dateUpdated": "2026-07-15T01:24:58.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51018 (GCVE-0-2022-51018)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.26.5 Input Validation via Book Pages
Summary
PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT ('book bombs'), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4).
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who obtains a writable book can create oversized NBT (\u0027book bombs\u0027), causing excess bandwidth consumption and server crashes (exceeding the 1 MB chunk size limit when saving region-based worlds in PM3, or exceeding the 32 KiB TAG_String limit in PM4)."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:10.538Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p62j-hrxm-xcxf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-p62j-hrxm-xcxf"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.26.5 Input Validation via Book Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.26.5-input-validation-via-book-pages"
}
],
"title": "PocketMine-MP before 3.26.5 Input Validation via Book Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51018",
"datePublished": "2026-09-07T12:55:10.538Z",
"dateReserved": "2026-09-05T21:04:08.629Z",
"dateUpdated": "2026-09-07T12:55:10.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51017 (GCVE-0-2022-51017)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
Summary
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/958a… | patch |
| https://github.com/pmmp/PocketMine-MP/commit/6492… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:09.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6fg-99pr-25m9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-c6fg-99pr-25m9"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/6492cac5c10f9fa8443ceddd2191a7b65b73f601"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.26.5-and-4.0.5-denial-of-service-via-skin-data"
}
],
"title": "PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51017",
"datePublished": "2026-09-07T12:55:09.862Z",
"dateReserved": "2026-09-05T21:03:47.627Z",
"dateUpdated": "2026-09-07T12:55:09.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51016 (GCVE-0-2022-51016)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay
Summary
PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.
Severity
6.1 (Medium)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/d28b… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Date Public
2022-01-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp"
}
],
"datePublic": "2022-01-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player\u0027s session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:09.180Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h79x-98r2-g6qc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h79x-98r2-g6qc"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/d28be4eaf24a890f7ef110a51181a3d806a6acca"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.0-authentication-bypass-via-login-replay"
}
],
"title": "PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51016",
"datePublished": "2026-09-07T12:55:09.180Z",
"dateReserved": "2026-09-05T21:03:26.820Z",
"dateUpdated": "2026-09-07T12:55:09.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51015 (GCVE-0-2022-51015)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
Summary
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/f126… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.6
(semver)
Unaffected: 4.0.6 (semver) |
Date Public
2022-01-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.6",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:08.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xh99-hw7h-wf63)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.6-denial-of-service-via-playeractionpacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51015",
"datePublished": "2026-09-07T12:55:08.508Z",
"dateReserved": "2026-09-05T21:03:22.919Z",
"dateUpdated": "2026-09-07T12:55:08.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51014 (GCVE-0-2022-51014)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
Summary
PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/56fe… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.7
(semver)
Unaffected: 4.0.7 (semver) |
Date Public
2022-01-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.7",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-01-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:07.817Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wjfq-88q2-r34j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wjfq-88q2-r34j"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/56fe71d939c38fe14e18a31a673a9331bcc0e4ca"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.7-denial-of-service-via-json-decoding"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51014",
"datePublished": "2026-09-07T12:55:07.817Z",
"dateReserved": "2026-09-05T21:03:00.814Z",
"dateUpdated": "2026-09-07T12:55:07.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51013 (GCVE-0-2022-51013)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
Summary
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c8e1… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.3
(semver)
Unaffected: 4.2.3 (semver) |
Date Public
2022-03-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "JavierLeon9966"
}
],
"datePublic": "2022-03-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:07.166Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-46c5-pfj8-fv65)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.3-denial-of-service-via-nbt-metadata"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51013",
"datePublished": "2026-09-07T12:55:07.166Z",
"dateReserved": "2026-09-05T21:02:39.792Z",
"dateUpdated": "2026-09-07T12:55:07.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51012 (GCVE-0-2022-51012)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
Summary
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5a98… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.9
(semver)
Unaffected: 4.2.9 (semver) |
Date Public
2022-04-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.9",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-04-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:06.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g5rr-p69h-7v3g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51012",
"datePublished": "2026-09-07T12:55:06.530Z",
"dateReserved": "2026-09-05T21:02:18.431Z",
"dateUpdated": "2026-09-07T12:55:06.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51011 (GCVE-0-2022-51011)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
Summary
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.
Severity
4.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/df33… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.2.10
(semver)
Unaffected: 4.2.10 (semver) |
Date Public
2022-05-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.10",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:05.898Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gj94-v4p9-w672)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-gj94-v4p9-w672"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.2.10 Denial of Service via Chat Messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.10-denial-of-service-via-chat-messages"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.2.10 Denial of Service via Chat Messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51011",
"datePublished": "2026-09-07T12:55:05.898Z",
"dateReserved": "2026-09-05T21:01:56.324Z",
"dateUpdated": "2026-09-07T12:55:05.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51010 (GCVE-0-2022-51010)
Vulnerability from cvelistv5 – Published: 2026-09-07 12:55 – Updated: 2026-09-07 12:55 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.4.2 Server Crash via Item ID
Summary
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5fd6… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.4.2
(semver)
Unaffected: 4.4.2 (semver) |
Date Public
2022-06-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.4.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-06-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T12:55:05.273Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fqx3-r75h-vc89)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.4.2 Server Crash via Item ID",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.4.2 Server Crash via Item ID",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51010",
"datePublished": "2026-09-07T12:55:05.273Z",
"dateReserved": "2026-09-05T21:01:35.395Z",
"dateUpdated": "2026-09-07T12:55:05.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51009 (GCVE-0-2022-51009)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
Summary
PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c962… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.7.2
(semver)
Unaffected: 4.7.2 (semver) |
Date Public
2022-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:18.057Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8cwq-4cmf-px73)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8cwq-4cmf-px73"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c9626c610b8f6810c8c987559c9197b2a291f0bb"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.7.2-denial-of-service-via-skin-geometry"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51009",
"datePublished": "2026-09-06T12:00:24.856Z",
"dateReserved": "2026-09-05T21:01:13.382Z",
"dateUpdated": "2026-09-06T12:50:18.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-51008 (GCVE-0-2022-51008)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
Summary
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining.
Severity
5.3 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/59be… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
4.0.0 , < 4.12.3
(semver)
Unaffected: 4.12.3 (semver) |
Date Public
2022-12-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.12.3",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.12.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "alvin0319"
}
],
"datePublic": "2022-12-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joining."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:17.386Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-474q-9hgp-hcvx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-474q-9hgp-hcvx"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/59be901efe6b7833e69e638e0e1497051ce96fa7"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.3-denial-of-service-via-unauthenticated-sessions"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-51008",
"datePublished": "2026-09-06T12:00:24.186Z",
"dateReserved": "2026-09-05T21:00:28.837Z",
"dateUpdated": "2026-09-06T12:50:17.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-48007 (GCVE-0-2021-48007)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
Summary
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/fb20… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 3.18.1
(semver)
Unaffected: 3.18.1 (semver) |
Date Public
2021-05-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "3.18.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.18.1",
"versionType": "semver"
}
]
}
],
"datePublic": "2021-05-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:16.713Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fm35-jgg3-3grx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.18.1-denial-of-service-via-moveplayerpacket"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-48007",
"datePublished": "2026-09-06T12:00:23.482Z",
"dateReserved": "2026-09-05T21:04:52.479Z",
"dateUpdated": "2026-09-06T12:50:16.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-48006 (GCVE-0-2021-48006)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
Summary
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.
Severity
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/4d37… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.0.3
(semver)
Unaffected: 4.0.3 (semver) |
Date Public
2021-12-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.0.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2021-12-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:16.053Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j5qg-w9jg-3wg3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-j5qg-w9jg-3wg3"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/4d37b79ff7f9d9452e988387f97919a9a1c4954e"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.3-operator-privilege-escalation-via-case-sensitivity"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-48006",
"datePublished": "2026-09-06T12:00:22.800Z",
"dateReserved": "2026-09-05T21:04:30.475Z",
"dateUpdated": "2026-09-06T12:50:16.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-37277 (GCVE-0-2020-37277)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-06 12:50 Unsupported When Assigned
VLAI
EPSS
VEX
Title
PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
Summary
PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/c368… | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 3.15.4
(semver)
Unaffected: 3.15.4 (semver) |
Date Public
2020-11-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "3.15.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.15.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "Muqsit"
},
{
"lang": "en",
"type": "analyst",
"value": "CortexPE"
}
],
"datePublic": "2020-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component\u0027s findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:50:15.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8jq6-w5cg-wm45)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-8jq6-w5cg-wm45"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/c368ebb5e74632bc622534b37cd1447b97281e20"
},
{
"name": "VulnCheck Advisory: PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-before-3.15.4-denial-of-service-via-inventorytransaction"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37277",
"datePublished": "2026-09-06T12:00:22.145Z",
"dateReserved": "2026-09-05T21:05:13.270Z",
"dateUpdated": "2026-09-06T12:50:15.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-7332 (GCVE-0-2023-7332)
Vulnerability from cvelistv5 – Published: 2025-12-31 21:37 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash
Summary
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-02 14:17 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pmmp/PocketMine-MP/blob/4.18.1… | release-notespatch |
| https://github.com/pmmp/PocketMine-MP/security/ad… | vendor-advisory |
| https://github.com/pmmp/PocketMine-MP/commit/5897476 | patch |
| https://www.vulncheck.com/advisories/pocketmine-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pmmp | PocketMine-MP |
Affected:
0 , < 4.18.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:17:28.604553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:35:36.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pmmp/PocketMine-MP",
"product": "PocketMine-MP",
"repo": "https://github.com/pmmp/PocketMine-MP",
"vendor": "pmmp",
"versions": [
{
"lessThan": "4.18.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player\u0027s hotbar, triggering a server crash and resulting in denial of service."
}
],
"value": "PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player\u0027s hotbar, triggering a server crash and resulting in denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:58.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pmmp/PocketMine-MP/commit/5897476"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "PocketMine-MP \u003c 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-7332",
"datePublished": "2025-12-31T21:37:38.838Z",
"dateReserved": "2025-12-31T20:56:56.399Z",
"dateUpdated": "2026-07-15T01:24:58.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}