CVE-2022-51013

PocketMine-MP versions before 4.2.3, an open-source dedicated server for Minecraft: Bedrock Edition, fail to validate damage metadata values in the NBT data clients send for tool and armor items (CWE-20). A connected player can send crafted itemstack NBT containing negative or out-of-range damage values, triggering unhandled exceptions in the Durable class that crash the server. The impact is denial of service: per the CVSS 4.0 vector, availability is heavily affected while confidentiality and integrity are unaffected, and only low privileges (a connected player session) are required. Any operator running an affected version is exposed, with public servers that allow item exchange or creative-style gameplay most likely to be targeted. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a low 0.5% probability of exploitation within 30 days.

What to do: Upgrade PocketMine-MP to version 4.2.3 or later. Operators who cannot upgrade immediately should check their current server version, be aware that any connected player can trigger a crash, and consider limiting access to trusted players or monitoring for server restarts. Given the low EPSS score and absence of a public PoC, urgent action beyond patching is not required.