High
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
Type: advisorySources: OSV
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-51012
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 04:22 UTC · Revision 1
Source evidence
PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
core-osv · Original sourcePublished 7 Sept 2026, 12:55 UTC
PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.
osv:CVE-2022-51012
Complete source record
{
"id": "343d5af69b7694140b0c59c2c9c24761c6e9c3a590d0c10ecdd8648fec834bcf",
"url": "https://osv.dev/vulnerability/CVE-2022-51012",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization",
"summary": "PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.",
"evidence": "osv:CVE-2022-51012",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-51012",
"aliases": [
"CVE-2022-51012",
"GHSA-g5rr-p69h-7v3g"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pmmp/pocketmine-mp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1d314ad4cef2a0f505a22f86ca29e26463b606da"
},
{
"fixed": "5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.2.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.2.8",
"4.2.7",
"4.2.6",
"4.2.5",
"4.2.4",
"4.2.3",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.0",
"4.1.0-BETA2",
"4.1.0-BETA1",
"4.0.0",
"3.26.1",
"3.26.0",
"3.25.6",
"3.25.5",
"3.25.4",
"3.25.3",
"3.25.2",
"3.25.1",
"3.25.0",
"3.24.0",
"3.23.1",
"3.23.0",
"3.22.5",
"3.22.4",
"3.22.3",
"3.22.2",
"3.22.1",
"3.22.0",
"3.21.1",
"3.21.0",
"3.20.0",
"3.19.3",
"3.19.2",
"3.19.1",
"3.18.2",
"3.19.0",
"3.18.1",
"3.17.7",
"3.18.0",
"3.17.6",
"3.17.5",
"3.17.4",
"3.17.3",
"3.17.2",
"3.17.1",
"3.17.0",
"3.16.1",
"3.16.0",
"3.15.4",
"3.15.3",
"3.15.2",
"3.15.1",
"3.15.0",
"3.14.3",
"3.14.2",
"3.14.1",
"3.14.0",
"3.13.1",
"3.13.0",
"3.12.6",
"3.12.5",
"3.12.4",
"3.12.3",
"3.12.2",
"3.12.1",
"3.11.7",
"3.12.0",
"3.11.6",
"3.11.5",
"3.11.4",
"3.11.3",
"3.11.2",
"3.11.1",
"3.10.1",
"3.11.0",
"3.9.8",
"3.10.0",
"3.9.7",
"3.9.6",
"3.9.5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.7",
"3.8.6",
"3.8.5",
"3.8.4",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.0",
"3.7.3",
"3.7.2",
"3.7.1",
"3.7.0",
"3.6.5",
"3.6.4",
"3.6.3",
"3.6.2",
"3.6.1",
"3.6.0",
"3.5.10",
"3.5.9",
"3.5.8",
"3.5.7",
"3.5.6",
"3.5.5",
"3.5.4",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.0",
"3.4.1",
"3.4.0",
"3.2.0",
"3.0.2",
"3.0.1",
"3.0.0",
"api/3.0.0-ALPHA12",
"1.7dev-937",
"api/3.0.0-ALPHA11",
"1.7dev-677",
"api/3.0.0-ALPHA10",
"1.7dev-501",
"api/3.0.0-ALPHA8",
"1.7dev-83",
"api/3.0.0-ALPHA6",
"1.6.2dev-229",
"api/3.0.0-ALPHA4",
"api/3.0.0-ALPHA3",
"api/3.0.0-ALPHA2",
"api/3.0.0-ALPHA1",
"api/2.1.0",
"1.6.1dev-87",
"api/2.0.0",
"1.6dev",
"api/1.11.0",
"1.4.1",
"1.4.1dev-936",
"1.4-916",
"1.4",
"Alpha_1.4dev-900",
"Alpha_1.4dev-855",
"Alpha_1.4dev-847",
"Alpha_1.4dev-842",
"Alpha_1.4dev-834",
"Alpha_1.4dev-707",
"Alpha_1.4dev-665",
"Alpha_1.4dev-659",
"Alpha_1.4dev-599",
"Alpha_1.4dev-576",
"Alpha_1.4dev-491",
"Alpha_1.4dev-478",
"Alpha_1.4dev-449",
"Alpha_1.4dev-413",
"Alpha_1.4dev-277",
"Alpha_1.4dev-228",
"Alpha_1.3.10",
"Alpha_1.3.9",
"Alpha_1.3.8",
"Alpha_1.3.7",
"Alpha_1.3.5",
"Alpha_1.3.4",
"Alpha_1.3.3",
"Alpha_1.3.2",
"Alpha_1.3.1",
"Alpha_1.3",
"Alpha_1.2.1",
"Alpha_1.2",
"Alpha_1.1.1",
"Alpha_1.1",
"Alpha_1.0.8",
"Alpha_1.0.7",
"Alpha_1.0.6",
"Alpha_1.0.5",
"Alpha_1.0.4",
"Alpha_1.0.3",
"Alpha_1.0.2",
"Alpha_1.0.1",
"Alpha_1.0",
"pocketmine-mp-rebrand"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-51012.json"
}
}
],
"modified": "2026-10-28T02:30:46.683613455Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51012.json",
"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-g5rr-p69h-7v3g",
"https://nvd.nist.gov/vuln/detail/CVE-2022-51012",
"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.2.9-denial-of-service-via-nbt-deserialization",
"https://github.com/pmmp/PocketMine-MP/commit/5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2"
],
"provider_metadata": {
"cwe_ids": [
"CWE-20"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51012.json"
}
},
"related_cves": [
{
"value": "CVE-2022-51012",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514603,
"published_at": "2026-09-07T12:55:06.53+00:00"
}