Item ID Validation Flaw in PocketMine-MP by PocketMine

CVE-2022-51010

What is CVE-2022-51010?

The PocketMine-MP server software has a critical flaw where it fails to securely validate item IDs received from clients within itemstack NBT data. This vulnerability can be exploited by sending specially crafted item IDs that lie outside the acceptable range, leading to an uncaught exception that causes the server to crash. This poses a severe risk to server stability and availability, potentially resulting in prolonged downtime or disruption of service for players. Users are advised to update to version 4.4.2 or later to mitigate this risk.

References