CVE-2022-51013 — PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range da…
Published: 2026-09-07 · CVSS: 7.1 · CVSS 4.0
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7