CVE-2022-51015

    Dashboard / Vulnerabilities / CVE-2022-51015

    CVE-2022-51015

    Published: 7 Sept 2026Last Modified: 10 Sept 2026

    Summary: PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

    Details: PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51015.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63, https://nvd.nist.gov/vuln/detail/CVE-2022-51015, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.0.6-denial-of-service-via-playeractionpacket, https://github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f7d25f251e431aace3ca835918b661583d32e6e7

    Affected versions

    4.0.5
    4.0.4
    4.0.3
    4.0.2
    4.0.1
    4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-51015 | CVE-DB