CVE-2022-51015
Received Received - Intake

Denial of Service in PocketMine-MP via Invalid Facing Values

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2022-51015
EUVD
EUVD-2022-56044

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pocketmine pocketmine-mp to 4.0.6 (exc)
pmmp pocketmine-mp to 4.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2022-51015 is a vulnerability in PocketMine-MP versions before 4.0.6 where the software fails to validate facing values in PlayerActionPacket and UseItemTransactionData. This allows remote authenticated attackers to send crafted packets with invalid facing values (e.g., negative numbers) to crash the server, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed PlayerActionPacket or InventoryTransactionPacket packets with invalid facing values. Inspect server logs for crashes or exceptions related to packet handling, particularly during block breaking actions. Use network monitoring tools to capture packets and check for negative or out-of-range facing values in START_BREAK, CRACK_BREAK, or UseItemTransactionData.

Impact Analysis

The vulnerability can cause server crashes, leading to downtime and unavailability for users. It requires remote authenticated access but no elevated privileges or user interaction to exploit. Servers running affected versions may become unresponsive or shut down.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the server, which could lead to temporary unavailability of services. For GDPR, this may impact the availability of personal data processing systems, potentially violating Article 32 requirements for security and integrity. For HIPAA, it could disrupt access to protected health information systems, affecting the availability requirement under the Security Rule.

Mitigation Strategies

Immediately update PocketMine-MP to version 4.0.6 or later to patch the vulnerability. As a temporary workaround, implement a plugin to validate facing values in PlayerActionPacket and cancel DataPacketReceiveEvent if invalid values (outside 0-5 range) are detected. Monitor server logs for crash attempts and block suspicious packets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-51015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart