CVE-2021-48007

    Dashboard / Vulnerabilities / CVE-2021-48007

    CVE-2021-48007

    Published: 6 Sept 2026Last Modified: 11 Sept 2026

    Summary:

    Details: PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

    References: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx, https://www.vulncheck.com/advisories/pocketmine-mp-before-3.18.1-denial-of-service-via-moveplayerpacket, https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -fd4ac885bb4d7d90e200b52d8e5d448c11f77663

    Affected versions

    3.17.7
    3.17.6
    3.17.5
    3.17.4
    3.17.3
    3.17.2
    3.17.1
    3.17.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-48007 | CVE-DB