Denial of Service Vulnerability in PocketMine-MP by PMMP

CVE-2022-51013

What is CVE-2022-51013?

A vulnerability exists in PocketMine-MP, where versions prior to 4.2.3 do not validate damage metadata values in tool and armor item NBT data received from clients. This flaw allows attackers to send negative or out-of-range damage values through itemstack NBT data, potentially leading to unhandled exceptions in the Durable class and resulting in server crashes. This poses a significant threat to server stability and uptime.

References