CVE-2022-51015

PocketMine-MP before 4.0.6 fails to validate the facing field in PlayerActionPacket (START_BREAK and CRACK_BREAK actions) and in UseItemTransactionData, which is typically carried inside InventoryTransactionPacket (CWE-20 improper input validation). A remote attacker who has joined a server can send crafted packets containing negative or out-of-range facing values, which crashes the server process. The impact is denial of service for all connected players, with no confidentiality or integrity loss and no code execution, consistent with the CVSS 4.0 score of 7.1. Anyone operating a PocketMine-MP server on a version before 4.0.6, including internet-exposed and community Minecraft Bedrock Edition servers, is affected. There is currently no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns roughly a 0.7% probability of exploitation within 30 days.

What to do: Upgrade to PocketMine-MP 4.0.6 or later. If upgrading is not immediately possible, restrict who can join via the server whitelist or other login controls, since exploitation requires an authenticated player session, and verify which version your currently running server reports. Crash-restart automation and monitoring are reasonable stopgaps because the sole impact is a server crash.