CVE-2022-51010: PocketMine-MP before 4.4.2 Server Crash via Item ID

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-07 · updated 2026-10-08
Weakness: CWE-20

Description

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

Affected products

pmmp PocketMine-MP: before 4.4.2 — fixed in 4.4.2

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.4.2. Check the vendor advisory for mitigations.

References

https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id

Get alerted when CVE-2022-51010 or the next vulnerability affects your stack