CVE-2022-51012: Pmmp Pocketmine-Mp

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

Affected products

• Pmmp Pocketmine-Mp: before 4.2.9 (fixed in 4.2.9)

Published 2026-09-07. Last modified 2026-10-08.