CVE-2022-51010

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs supplied by clients in itemstack NBT data. A connected player can send an item ID outside the valid range, which triggers an uncaught exception and terminates the server process. The impact is a remote denial of service: the attacker gains the ability to crash the server and disconnect every player on it, with no confidentiality or integrity impact. Any operator running PocketMine-MP prior to 4.4.2 is affected, particularly operators of internet-facing servers where anyone can join and send crafted packets. Exploitation is not currently known: there is no public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at about 0.5%.

What to do: Upgrade to PocketMine-MP 4.4.2 or later, which adds validation of client-supplied item IDs. Until patched, restrict server access to trusted players where possible, since exploitation requires only a connected client joining the server. Operators should verify their running version and monitor for unexplained crashes or mass player disconnects.