CVE-2022-51013: Pmmp Pocketmine-Mp

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

Affected products

• Pmmp Pocketmine-Mp: before 4.2.3 (fixed in 4.2.3)

Published 2026-09-07. Last modified 2026-10-08.