Denial of Service in PocketMine-MP by Invalid PlayerActionPacket Handling
CVE-2022-51015

7.1HIGH

Key Information:

Vendor

Pmmp

Status
Pocketmine-mp
Vendor
CVE Published:
7 September 2026

What is CVE-2022-51015?

PocketMine-MP versions prior to 4.0.6 contain a vulnerability that fails to properly validate 'facing' values in specific packets related to player actions. This oversight allows remote authenticated attackers to send specially crafted packets containing invalid facing values, which can lead to server crashes and result in an effective denial of service. It is crucial for users of PocketMine-MP to update to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

PocketMine-MP 0 < 4.0.6

PocketMine-MP 4.0.6

References

https://github.com/pmmp/PocketMine-MP/security/advisories...
vendor-advisory
https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff...
patch
https://www.vulncheck.com/advisories/pocketmine-mp-before...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.