CVE-2022-51013
Received Received - Intake

PocketMine-MP Denial of Service via Negative Damage Values

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2022-51013
EUVD
EUVD-2022-56042

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pocketmine pocketmine-mp to 4.2.3 (exc)
pocketmine mp to 4.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in PocketMine-MP versions before 4.2.3. It occurs because the software fails to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values, causing unhandled exceptions in the Durable class and server crashes.

Detection Guidance

To detect this vulnerability, monitor for server crashes when clients send invalid NBT metadata. Check PocketMine-MP server logs for exceptions related to Durable->setDamage() or TypeConversionException. Ensure your server runs version 4.2.3 or later to avoid the issue.

Impact Analysis

This vulnerability allows remote attackers to cause server crashes by sending specially crafted item data. This results in a Denial of Service, making the server unavailable to legitimate users. The attack requires low privileges and no user interaction.

Compliance Impact

This vulnerability primarily causes server crashes due to improper input validation in NBT metadata handling, leading to denial of service. It does not directly impact data confidentiality or integrity but may indirectly affect compliance by disrupting service availability, which could violate uptime requirements in regulations like GDPR or HIPAA that mandate reliable access to personal or health data.

Mitigation Strategies

Immediately update PocketMine-MP to version 4.2.3 or later to patch the vulnerability. If updating is not possible, restrict client access to trusted sources only and monitor network traffic for malformed NBT metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart