Is CVE-2023-7332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-7332 being exploited in the wild.

How severe is CVE-2023-7332?

Low severity, with a CVSS score of 3.1, published 31 December 2025.

Which products and versions are affected?

pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.18.1; Pmmp PocketMine-MP < 4.18.1.

Is there a fix for CVE-2023-7332?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-7332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-7332?

Check whether you run pocketmine/pocketmine-mp (Packagist) or Pmmp PocketMine-MP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-7332: pmmp PocketMine-MP improper input validation in inventory transaction handling

Q: Is there a fix for CVE-2023-7332?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-7332 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-7332?

Check whether you run pocketmine/pocketmine-mp (Packagist) or Pmmp PocketMine-MP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-7332 · Severity: low · CVSS 3.1 · Published 2025-12-31

PocketMine-MP, a popular server software for Minecraft: Bedrock Edition, contains a flaw in how it handles player inventory actions. An authenticated player can intentionally trigger a server crash by requesting to drop more items than they actually possess in their inventory. This results in a denial-of-service, making the game server unavailable to all other players.

Technologies: pocketmine/pocketmine-mp (Packagist), Pmmp PocketMine-MP. Vendors: Packagist, Pmmp.

Quick answers

Is CVE-2023-7332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-7332 being exploited in the wild.
How severe is CVE-2023-7332?: Low severity, with a CVSS score of 3.1, published 31 December 2025.
Which products and versions are affected?: pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.18.1; Pmmp PocketMine-MP < 4.18.1.
Is there a fix for CVE-2023-7332?: Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-7332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-7332?: Check whether you run pocketmine/pocketmine-mp (Packagist) or Pmmp PocketMine-MP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.1 or later
```
composer require pocketmine/pocketmine-mp:^4.18.1
```

Technical details

An improper input validation vulnerability (CWE-1284) exists in PocketMine-MP's InGamePacketHandler. The flaw was introduced during a revamp of inventory network handling in version 4.18.0. A remote attacker with a valid player session can send a crafted inventory transaction request to drop a quantity of items exceeding what is available in their hotbar. The server fails to validate this quantity against the actual slot count, leading to an unhandled exception and subsequent process crash. The issue is resolved in version 4.18.1 by adding a check in handleNormalTransaction to ensure the dropped count does not exceed the source slot's item count.

Affected products

pmmp PocketMine-MP < 4.18.1

Identifiers

CVE-2023-7332
GHSA-h87r-f4vc-mchv

Timeline

2023-05-30: advisory: GitHub Advisory GHSA-h87r-f4vc-mchv published
2023-05-30: patched: Fixed in version 4.18.1 via commit 5897476
2025-12-31: disclosed: CVE-2023-7332 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.