Executive brief
PocketMine-MP is a Minecraft server implementation. Versions before 4.2.9 fail to properly validate NBT (Named Binary Tag) data types during inventory transaction processing, allowing attackers to send malformed inventory packets that crash the server and cause service outages.
Technical details
The vulnerability exists in the deserialization of NBT data from client inventory transaction packets. The server does not adequately validate ListTag types (such as the CanDestroy tag) when processing inventory interactions, allowing an attacker to provide incorrect or malformed NBT structures. This affects inventory transaction and player auth input packet handling. An attacker on the network with low privileges (authenticated player) can send a crafted inventory transaction packet without user interaction to trigger a server crash via type validation bypass. The vulnerability is fixed in version 4.2.9 via proper TAG_List type checks.
Affected products
- PocketMine PocketMine-MP before 4.2.9
Timeline
- 2022-04-19: advisory: GHSA advisory published
- 2022-04-19: patched: Fixed in version 4.2.9
- 2026-09-07: disclosed: CVE-2022-51012 published on NVD