CVE-2022-51012: PocketMine-MP NBT DOS Vulnerability

CVE-2022-51012 Overview

CVE-2022-51012 affects PocketMine-MP versions before 4.2.9, a server software implementation for Minecraft: Bedrock Edition. The vulnerability stems from inadequate validation of Named Binary Tag (NBT) data types during deserialization of inventory transaction packets. Authenticated clients can send crafted inventory transactions containing malformed NBT tags to crash the server process. Successful exploitation results in denial of service against the Minecraft server, disconnecting all connected players. The flaw is categorized under [CWE-20] Improper Input Validation.

Critical Impact
A low-privileged remote attacker with a valid client connection can crash a PocketMine-MP server by transmitting inventory transaction packets containing NBT tags with unexpected list element types.

Affected Products

PocketMine-MP versions prior to 4.2.9
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Plugins and tile entities relying on the vulnerable ContainerTrait and Banner classes

Discovery Timeline

2026-09-07 - CVE-2022-51012 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-51012

Vulnerability Analysis

PocketMine-MP processes NBT payloads embedded in inventory transaction packets sent by connected clients. The deserialization code in src/block/tile/ContainerTrait.php and src/item/Banner.php retrieved ListTag structures without confirming the tag type of contained elements. When a client submitted a ListTag whose element type differed from the expected TAG_Compound, downstream code attempted to invoke methods available only on compound tags, raising an uncaught exception that terminated the server process. Because the packet handler runs before any structural validation, the crash occurs during normal gameplay input processing rather than through administrative interfaces.

Root Cause

The loadItems() method in ContainerTrait checked only that the retrieved tag was an instance of ListTag, omitting a check on the list's declared element type. NBT list tags carry a TAG_Type field that dictates the allowed member type; failing to validate this field allowed clients to smuggle unexpected type combinations into container reload paths and banner pattern arrays.

Attack Vector

An attacker connects to a vulnerable server as a regular player and issues an inventory transaction that references a container or banner item carrying a crafted NBT ListTag. The list declares a non-Compound element type while the server code assumes compound entries. The resulting type mismatch throws an unhandled error, halting the main server loop and disconnecting every session.

php

// Patch: src/block/tile/ContainerTrait.php
// Adds an explicit NBT list element-type check before iterating items
	abstract public function getRealInventory();

	protected function loadItems(CompoundTag $tag) : void{
-		if(($inventoryTag = $tag->getTag(Container::TAG_ITEMS)) instanceof ListTag){
+		if(($inventoryTag = $tag->getTag(Container::TAG_ITEMS)) instanceof ListTag && $inventoryTag->getTagType() === NBT::TAG_Compound){
			$inventory = $this->getRealInventory();
			$listeners = $inventory->getListeners()->toArray();
			$inventory->getListeners()->remove(...$listeners); //prevent any events being fired by initialization

Source: PocketMine-MP commit 5a98b08

A companion change in src/item/Banner.php imports the NBT class to enforce the same element-type validation on banner pattern lists:

php

 use pocketmine\block\utils\DyeColor;
 use pocketmine\data\bedrock\BannerPatternTypeIdMap;
 use pocketmine\data\bedrock\DyeColorIdMap;
+use pocketmine\nbt\NBT;
 use pocketmine\nbt\tag\CompoundTag;
 use pocketmine\nbt\tag\ListTag;
 use function count;

Source: PocketMine-MP commit 5a98b08

Detection Methods for CVE-2022-51012

Indicators of Compromise

Unexpected termination of the PocketMine-MP process shortly after a client authenticates and interacts with an inventory
Server logs containing TypeError or AssumptionFailedError stack traces originating in ContainerTrait::loadItems() or Banner::deserializeCompoundTag()
Repeated crash-restart cycles correlated with connections from a specific player UUID or source IP

Detection Strategies

Parse PocketMine-MP crash dump files under crashdumps/ for exceptions referencing NBT list type mismatches
Alert on abnormal disconnect storms where every session drops within milliseconds of one another
Monitor process supervisors (systemd, Docker, pterodactyl) for elevated restart counts on Minecraft server units

Monitoring Recommendations

Forward PocketMine-MP logs and crash dumps to a centralized logging platform for correlation
Track packet rates per player and flag clients issuing malformed inventory transaction packets
Retain network captures on the Bedrock UDP port to support post-incident analysis of crafted NBT payloads

How to Mitigate CVE-2022-51012

Immediate Actions Required

Upgrade PocketMine-MP to version 4.2.9 or later on all production and staging servers
Restart the server process after upgrade to ensure the patched deserialization code is loaded
Review installed plugins that persist custom NBT data and confirm they validate ListTag element types

Patch Information

The fix is delivered in PocketMine-MP 4.2.9 via commit 5a98b08. The patch adds NBT::TAG_Compound element-type validation to ContainerTrait::loadItems() and adjacent deserialization routines. Additional context is available in the GitHub Security Advisory GHSA-g5rr-p69h-7v3g and the VulnCheck Denial of Service Advisory.

Workarounds

Restrict server access to allowlisted players using whitelist mode until the patched version is deployed
Deploy a process supervisor with automatic restart to limit downtime from crash-triggered denial of service
Rate-limit inbound Bedrock traffic per source address at the network edge to slow repeated crash attempts

bash

# Update PocketMine-MP using the official installer script
./start.sh --version=4.2.9

# Or pin the version in composer.json for source deployments
composer require pocketmine/pocketmine-mp:^4.2.9

# Verify the running version after restart
php PocketMine-MP.phar --version