CVE-2022-51010 json
PocketMine-MP before 4.4.2 Server Crash via Item ID
published 2022-06-07 4 y ago modified 2026-10-08 31 d ago also GHSA-fqx3-r75h-vc89 , EUVD-2022-56039
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.
Patch / fix
- packagist pocketmine/pocketmine-mp 4.4.2
- pmmp PocketMine-MP 4.4.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pocketmine/pocketmine-mp | >=4.0.0-BETA5, <4.4.2 |
4.4.2 |
Affected products
- pmmp PocketMine-MP
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7
patch, web
-
github.com
/pmmp/PocketMine-MP/commit/8ac16345a3bc099b62c1f5cfbf3b736e621c3f76
web
-
github.com
/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89
vendor-advisory, web
-
vulncheck.com
/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id
third-party-advisory
-
github.com
/pmmp/PocketMine-MP
package
Sources
- CVE List CVE-2022-51010
- GitHub Advisory GHSA-fqx3-r75h-vc89
- NVD CVE-2022-51010
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.