{"id":"CVE-2021-48007","aliases":["GHSA-fm35-jgg3-3grx"],"url":"https://o3.security/vulnerability/CVE-2021-48007","summary":"NaN/INF in serverbound movement packets can crash clients and servers","details":"### Impact\nA malicious client may send a `MovePlayerPacket` to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.\n\n- The server may crash in various ways if this exploit is used, because some mathematical operations on NaN/INF generate PHP warnings, which are converted into exceptions.\n- Clients may not be able to see other clients who have a NaN/INF rotation.\n- Clients may also crash in such cases.\n\n### Patches\nA patch for this was included in the 3.18.1 release: https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638\n\n### Workarounds\nWorkarounds could be implemented as plugins using `DataPacketReceiveEvent` to block any inbound movement packets containing bogus values.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)\n- Email us at [team@pmmp.io](mailto:team@pmmp.io)","published":"2026-09-06T12:17:14.783Z","modified":"2026-10-20T10:55:11.741932900Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"3.18.1"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638","label":"pmmp/PocketMine-MP@fb20bb3"},"references":[{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-3.18.1-denial-of-service-via-moveplayerpacket"},{"type":"FIX","url":"https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:55:11.741932900Z"}}