CVE-2022-51015: PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for STARTBREAK and CRACKBREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote authenticated attacker can exploit it. The attacker must be able to connect and send crafted protocol packets to the PocketMine-MP server.
What packets and values trigger the denial of service?
The issue affects invalid facing values in PlayerActionPacket for START_BREAK and CRACK_BREAK actions, and in UseItemTransactionData, typically carried in an InventoryTransactionPacket. Negative or out-of-range facing values can crash the server.
Which versions are affected?
PocketMine-MP versions before 4.0.6 are affected. Upgrading to 4.0.6 or later addresses the missing validation described in the advisory.