{"id":"CVE-2022-51013","aliases":["GHSA-46c5-pfj8-fv65"],"url":"https://o3.security/vulnerability/CVE-2022-51013","summary":"PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata","details":"### Impact\nDue to a workaround applied in 1.13, an attacker may send a negative damage/meta value in a tool or armour item's NBT, which `TypeConverter` then blindly uses as if it was valid without being checked.\n\nWhen this invalid metadata value reaches `Durable->setDamage()`, an exception is thrown because the metadata is not within the expected range for damage values.\n\nThis can be reproduced with either a too-large damage value, or a negative one.\n\n### Patches\nc8e1cfcbee4945fd4b63d2a7e96025c59744d4f1\n\n### Workarounds\nIn theory this can be checked by plugins using a custom `TypeConverter`, but this is likely to be very cumbersome.\n\n### For more information\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)","published":"2026-09-07T12:55:07.166Z","modified":"2026-10-09T02:45:38.335972879Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"4.2.4"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1","label":"pmmp/PocketMine-MP@c8e1cfc"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51013.json"},{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-46c5-pfj8-fv65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51013"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.3-denial-of-service-via-nbt-metadata"},{"type":"FIX","url":"https://github.com/pmmp/PocketMine-MP/commit/c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-09T02:45:38.335972879Z"}}