{"id":"CVE-2022-51013","aliases":[],"url":"https://o3.security/vulnerability/CVE-2022-51013","summary":"PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage…","details":"PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.","published":"2026-09-07T13:17:23.173","modified":"2026-09-07T13:17:23.173","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1","label":"pmmp/PocketMine-MP@c8e1cfc"},"references":[{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.3-denial-of-service-via-nbt-metadata"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-07T13:17:23.173"}}