CVE-2022-51012CWE-20

CVE-2022-51012

Medium · published September 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-07T17:17Z
References (3)
https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2 · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization · [email protected]
EPSS history
Timeline
  • 09 SEP 03:12Z
    EPSS moved — → 1%
    epss
  • 07 SEP 12:55Z
    PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
    cvelistv5