CVE-2021-48007: PocketMine-MP Server DoS Vulnerability

CVE-2021-48007 Overview

CVE-2021-48007 is a denial-of-service vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 3.18.1 fail to validate NaN (Not-a-Number) or INF (infinity) values in the MovePlayerPacket position and rotation fields. Authenticated malicious clients can send crafted movement packets containing invalid floating-point values. The server processes these values through mathematical operations that either crash the server process or prevent connected clients from rendering other players. The flaw is classified under CWE-20: Improper Input Validation.

Critical Impact
Any authenticated player can crash a PocketMine-MP server or degrade rendering for other users by sending malformed movement packets containing NaN or INF floating-point values.

Affected Products

PocketMine-MP versions before 3.18.1
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Any server plugin or fork inheriting the unpatched Player.php movement handler

Discovery Timeline

2026-09-06 - CVE-2021-48007 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2021-48007

Vulnerability Analysis

The vulnerability resides in the movement handling logic of PocketMine-MP's Player.php class. When a client transmits a MovePlayerPacket, the server reads floating-point coordinates for position (x, y, z) and rotation (yaw, pitch). The server does not check whether these values are NaN or infinite before passing them into downstream mathematical operations. IEEE 754 semantics guarantee that arithmetic on NaN propagates undefined results, and infinities cause overflow behavior in bounding-box, chunk-index, and physics calculations.

Exploitation requires only a valid session on the server. An attacker joins as a normal player and transmits crafted movement packets. The malformed values propagate into position updates broadcast to other clients, breaking their rendering pipelines, or into server-side geometry checks that terminate the server process.

Root Cause

The root cause is missing input validation on untrusted floating-point fields deserialized from network packets. PHP's built-in helpers is_nan() and is_infinite() were not invoked prior to using the values in game-state math. Without a numeric domain check, any bit pattern permitted by IEEE 754 was accepted as a legitimate coordinate.

Attack Vector

The attack vector is network-based and requires low-privilege access — an authenticated player session on the target server. No user interaction from other players is required. The impact is limited to availability; confidentiality and integrity are not affected.

php

// Security patch in src/pocketmine/Player.php
// Adds is_nan() and is_infinite() imports used to reject invalid floats
 use function gettype;
 use function implode;
 use function in_array;
+use function is_infinite;
 use function is_int;
+use function is_nan;
 use function is_object;
 use function is_string;
 use function json_encode;

Source: PocketMine-MP commit fb20bb38

Detection Methods for CVE-2021-48007

Indicators of Compromise

Unexpected PocketMine-MP process crashes or fatal PHP errors referencing math functions on player coordinates
Server logs showing player disconnects immediately followed by rendering failures reported by other clients
MovePlayerPacket entries containing coordinate fields that decode to NaN or INF
Repeated movement packets from a single session preceding server termination

Detection Strategies

Inspect packet capture data on the Minecraft Bedrock UDP port for MovePlayerPacket payloads and flag floating-point fields matching the IEEE 754 NaN (0x7FC00000) or infinity (0x7F800000) bit patterns
Add server-side logging around movement handling to record the raw x, y, z, yaw, and pitch values received prior to processing
Correlate server restart events with the last connected player session to identify abuse

Monitoring Recommendations

Monitor PocketMine-MP process uptime and restart frequency; sudden decreases indicate abuse or instability
Alert on PHP fatal error patterns emitted from Player.php movement code paths
Track per-player packet rates for MovePlayerPacket to identify anomalous flooding preceding crashes

How to Mitigate CVE-2021-48007

Immediate Actions Required

Upgrade PocketMine-MP to version 3.18.1 or later where is_nan() and is_infinite() checks reject invalid movement values
Audit any forks or custom plugins that override movement handling to ensure they apply equivalent validation
Restrict server access to trusted players until the upgrade is deployed

Patch Information

The upstream fix is committed in PocketMine-MP commit fb20bb38 and documented in the GitHub Security Advisory GHSA-fm35-jgg3-3grx. VulnCheck published additional details in the PocketMine-MP Denial of Service Advisory. Operators should update through Composer or replace the server binary with the patched release.

Workarounds

Deploy a proxy or plugin that rejects MovePlayerPacket frames containing non-finite floating-point values before they reach the core server
Enable server process supervisors that auto-restart PocketMine-MP after abnormal exits to reduce downtime while patches are staged
Use allow-lists to restrict server participation to known player accounts pending remediation

bash

# Upgrade PocketMine-MP via Composer to the patched release
composer require pocketmine/pocketmine-mp:^3.18.1

# Verify the installed version
php PocketMine-MP.phar --version