Detections
Analytics

CVE-2022-51010

high

Description

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

References

https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id

https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89

https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-56039

Details

Source: Mitre, NVD

Published: 2026-09-07

Updated: 2026-10-08

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity: Medium

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00508