CVE-2022-51012

PocketMine-MP, a widely used open-source server implementation for Minecraft: Bedrock Edition, fails to properly validate NBT data types when deserializing inventory transaction packets sent by clients. A player with an account on the server (low privileges, no user interaction required) can send a crafted inventory transaction containing malformed NBT tags, causing the server process to crash. The attacker gains denial of service only, with no confidentiality or integrity impact per the CVSS scoring, but a single malicious client can repeatedly crash the affected server. Any operator running PocketMine-MP before version 4.2.9 is affected, with public servers that accept arbitrary players most exposed. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

What to do: Upgrade PocketMine-MP to version 4.2.9 or later. Until patched, restrict access to trusted players (e.g., via whitelisting), since any authenticated client can crash the server, and monitor public servers for unexplained crashes or restarts. No public exploit is known and EPSS is low, but internet-facing servers should patch promptly because the attack requires only a logged-in player.