CVE-2022-51010

    Dashboard / Vulnerabilities / CVE-2022-51010

    CVE-2022-51010

    Published: 7 Sept 2026Last Modified: 10 Sept 2026

    Summary: PocketMine-MP before 4.4.2 Server Crash via Item ID

    Details: PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51010.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89, https://nvd.nist.gov/vuln/detail/CVE-2022-51010, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id, https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bcb0e2ff1f36b3642fc9ea84e04e6293d779a67a

    Affected versions

    4.4.1
    4.4.0
    4.4.0-BETA1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-51010 | CVE-DB