CVE-2021-48007 — PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets wit…
Published: 2026-09-06 · CVSS: 7.1 · CVSS 4.0
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7