CVE-2022-51013

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.2.3

Description The software fails to validate damage metadata values in tool and armor item NBT (Named Binary Tag) data received from clients. Due to a workaround applied in version 1.13, the TypeConverter uses these values without verification. When an attacker sends negative or out-of-range damage values in the itemstack NBT, it triggers an unhandled exception in the setDamage() function of the Durable class, resulting in a server crash.

Recommendations Update to version 4.2.3 or later.