CVE-2021-48007
Received Received - Intake

PocketMine-MP Pre-3.18.1 NaN/INF Packet Validation Flaw

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulnCheck

Description
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2021-48007
EUVD
EUVD-2021-34877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pocketmine-mp pocketmine-mp to 3.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in PocketMine-MP versions before 3.18.1. It occurs because the software fails to validate NaN (Not a Number) or INF (Infinity) values in the position and rotation fields of MovePlayerPacket. Malicious clients can send crafted packets with these invalid floating-point values to crash servers or disrupt client rendering.

Detection Guidance

Monitor PocketMine-MP server logs for crashes or exceptions related to MovePlayerPacket handling. Check for packets with NaN or INF values in position or rotation fields. Use network monitoring tools to inspect incoming packets for malformed floating-point values in movement data.

Impact Analysis

If you run a PocketMine-MP server before version 3.18.1, attackers can exploit this to crash your server by sending malformed movement packets. Players may experience visual glitches or crashes when encountering invalid rotation values. The server may also crash due to unhandled mathematical operations from these invalid values.

Compliance Impact

This vulnerability primarily impacts system availability by causing crashes through crafted packets. It does not directly affect confidentiality or integrity of data, which are key concerns for GDPR and HIPAA. However, repeated DoS attacks could disrupt service availability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade PocketMine-MP to version 3.18.1 or later to apply the patch. If immediate upgrade is not possible, implement input validation to reject packets with NaN or INF values in movement fields. Restrict network access to trusted clients if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2021-48007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart