CVE-2022-51015
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 07, 2026
Vendor
unknown
Description
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.