PT-2026-86777 · Pmmp+2 · Pocketmine-Mp+1

CVE-2022-51015

·

Published

2022-01-13

·

Updated

2026-09-07

CVSS v3.1
CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values (e.g. negative), specifically with START BREAK or CRACK BLOCK actions, or with a UseItemTransactionData (typically in InventoryTransactionPacket).

Patches

f126479c37ff00a717a828f5271cf8e821d12d6c

Workarounds

Using a plugin, cancel DataPacketReceiveEvent if the packet is PlayerActionPacket and the facing is outside the range 0-5 when receiving START BREAK or CRACK BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.

For more information

If you have any questions or comments about this advisory:

Exploit

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-51015
GHSA-XH99-HW7H-WF63

Affected Products

Pocketmine-Mp
Pocketmine/Pocketmine-Mp