CVE-2022-51010 Overview
CVE-2022-51010 affects PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions prior to 4.4.2 fail to validate item IDs received from clients within itemstack NBT (Named Binary Tag) data. An authenticated attacker can send a crafted item ID outside the signed 16-bit range to trigger an uncaught TypeConversionException, crashing the server process. The flaw is classified as improper input validation [CWE-20] and produces a denial-of-service condition against the game server.
Critical Impact
Any authenticated player can crash a PocketMine-MP server by transmitting a malformed item ID in NBT data, disrupting service availability for all connected users.
Affected Products
- PocketMine-MP versions prior to 4.4.2
- TypeConverter component in src/network/mcpe/convert/TypeConverter.php
- Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Discovery Timeline
- 2026-09-07 - CVE-2022-51010 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2022-51010
Vulnerability Analysis
The vulnerability resides in the TypeConverter class responsible for converting network item stack data into internal server representations. When a client transmits itemstack NBT data, the server deserializes the item ID field without enforcing bounds against the valid signed 16-bit integer range. Passing an out-of-range value causes downstream conversion logic to raise an uncaught exception. The exception propagates up the network handler stack and terminates the server process.
Because exploitation only requires an authenticated session on the server, any player who can join the game can trigger the crash. The impact is limited to availability; no memory corruption or code execution occurs. Repeated exploitation prevents server operators from maintaining stable uptime until the patched release is deployed.
Root Cause
The root cause is missing range validation on the $id parameter during itemstack conversion. The pre-patch code validated the $meta field but performed no equivalent check on $id, allowing values outside -0x8000 to 0x7fff to reach code paths that assume a valid signed 16-bit identifier.
Attack Vector
An attacker connects to the PocketMine-MP server as an authenticated player, then transmits an itemstack packet containing crafted NBT data with an item ID outside the supported range. The server raises an unhandled TypeConversionException and terminates.
// Patch adding bounds check in src/network/mcpe/convert/TypeConverter.php
$compound = null;
}
}
+ if($id < -0x8000 || $id >= 0x7fff){
+ throw new TypeConversionException("Item ID must be in range " . -0x8000 . " ... " . 0x7fff . " (received $id)");
+ }
if($meta < 0 || $meta >= 0x7fff){ //this meta value may have been restored from the NBT
throw new TypeConversionException("Item meta must be in range 0 ... " . 0x7fff . " (received $meta)");
}
Source: PocketMine-MP commit 5fd685e
Detection Methods for CVE-2022-51010
Indicators of Compromise
- Sudden PocketMine-MP process termination correlated with a recently connected player session
- Server log entries containing TypeConversionException referencing item ID conversion in TypeConverter.php
- Repeated unexpected server restarts shortly after client join events from the same account or IP address
Detection Strategies
- Monitor PocketMine-MP crash logs for uncaught exceptions originating in src/network/mcpe/convert/TypeConverter.php
- Alert on server process exits that occur within seconds of packet processing from a specific client session
- Correlate authentication events with subsequent crash traces to identify attacker accounts
Monitoring Recommendations
- Ship PocketMine-MP stdout and crash dumps to a centralized log store for exception pattern analysis
- Track process uptime metrics and generate alerts on abnormal restart frequency
- Maintain an audit trail of player join events with source IP for post-incident attribution
How to Mitigate CVE-2022-51010
Immediate Actions Required
- Upgrade PocketMine-MP to version 4.4.2 or later, which enforces item ID bounds validation
- Restrict server access to trusted players via whitelist while patching is in progress
- Review server crash logs for prior exploitation attempts and identify offending accounts
Patch Information
The fix is committed in PocketMine-MP commit 5fd685e and released in version 4.4.2. The patch adds an explicit range check rejecting item IDs below -0x8000 or greater than or equal to 0x7fff before further processing. Full advisory details are published in GHSA-fqx3-r75h-vc89 and the VulnCheck PocketMine advisory.
Workarounds
- Enable server whitelisting to limit access to known, trusted players until the patch is applied
- Ban and block IP addresses of any account observed triggering TypeConversionException crashes
- Configure process supervision (for example, systemd or a wrapper script) to automatically restart the server and preserve availability during remediation
# Upgrade PocketMine-MP using the official installer
./start.sh --update
# Verify installed version is 4.4.2 or later
php PocketMine-MP.phar --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
