CVE-2021-48007: Pmmp Pocketmine-Mp

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Affected products

• Pmmp Pocketmine-Mp: before 3.18.1 (fixed in 3.18.1)

Published 2026-09-06. Last modified 2026-10-08.