What’s Vulnerable › Vulnerabilities

CVE-2022-51012: PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-07 · updated 2026-10-08
• Weakness: CWE-20

Description

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

Affected products

• pmmp PocketMine-MP: before 4.2.9 — fixed in 4.2.9

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g
• https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization

Get alerted when CVE-2022-51012 or the next vulnerability affects your stack