CVE-2022-51013: PocketMine-MP Denial of Service Vulnerability

CVE-2022-51013 Overview

CVE-2022-51013 affects PocketMine-MP versions before 4.2.3, a server software implementation for Minecraft: Bedrock Edition. The vulnerability allows authenticated clients to crash the server by sending malformed Named Binary Tag (NBT) data for tool or armor items. Specifically, the server fails to validate damage metadata values received from clients, allowing negative or out-of-range integers to trigger unhandled exceptions in the Durable class. The flaw is classified as an input validation issue [CWE-20] and results in denial of service.

Critical Impact
Any authenticated player can remotely crash a PocketMine-MP server by transmitting crafted itemstack NBT data containing invalid damage metadata values.

Affected Products

PocketMine-MP versions prior to 4.2.3
Minecraft: Bedrock Edition server deployments using PocketMine-MP
TypeConverter component in src/network/mcpe/convert/

Discovery Timeline

2026-09-07 - CVE-2022-51013 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-51013

Vulnerability Analysis

The vulnerability resides in PocketMine-MP's TypeConverter class, which handles conversion of network item data into internal item objects. When a client sends an itemstack containing NBT data, the server extracts a meta value representing item damage or durability state. The code path does not enforce range constraints on this value before instantiating a Durable item. When the value falls outside the expected 0 to 0x7fff range, the Durable class raises an unhandled exception. The exception propagates up the packet handler and terminates the server process, disconnecting all players.

Root Cause

The root cause is missing input validation on deserialized NBT metadata [CWE-20]. The server treats client-supplied meta as trusted after NBT restoration. Because item damage is a signed 16-bit-style field, negative values and values above 0x7fff produce states the durability logic cannot represent. The absence of a bounds check before item construction converts malformed input into a fatal runtime error.

Attack Vector

Exploitation requires network access and low-privilege authentication as a player on the target server. The attacker crafts an inventory packet containing an item with NBT metadata specifying an out-of-range damage value. Upon receipt, the server invokes TypeConverter to reconstruct the item, triggering the exception and crashing the process. No user interaction from other players is required.

php

// Patch from src/network/mcpe/convert/TypeConverter.php
				$compound = null;
			}
		}
+		if($meta < 0 || $meta >= 0x7fff){ //this meta value may have been restored from the NBT
+			throw new TypeConversionException("Item meta must be in range 0 ... " . 0x7fff . " (received $meta)");
+		}

		try{
			return ItemFactory::getInstance()->get(

Source: PocketMine-MP commit c8e1cfc

The patch introduces an explicit range check that raises a TypeConversionException before the invalid value reaches the Durable item constructor, allowing the packet handler to reject the input cleanly instead of crashing.

Detection Methods for CVE-2022-51013

Indicators of Compromise

Unexpected server process termination correlated with recent player logins or inventory actions.
PHP fatal error entries referencing the Durable class or TypeConverter in server logs.
Repeated abrupt disconnections of all connected players followed by service restart events.
Inbound Minecraft protocol packets containing item NBT with Damage tags outside the 0 to 32767 range.

Detection Strategies

Parse PocketMine-MP crash dumps for stack traces originating in src/network/mcpe/convert/TypeConverter.php or the Durable item hierarchy.
Instrument the server wrapper to log the source IP and account associated with the last processed packet before a crash.
Correlate server restart frequency against player join events to identify repeatable crash patterns tied to specific accounts.

Monitoring Recommendations

Enable verbose logging on inbound InventoryTransactionPacket and item conversion paths during triage.
Track PocketMine-MP version strings across your fleet to identify hosts still running versions below 4.2.3.
Alert on process supervisor restart loops for the PocketMine-MP service, which commonly indicate exploitation attempts.

How to Mitigate CVE-2022-51013

Immediate Actions Required

Upgrade PocketMine-MP to version 4.2.3 or later, which contains the range check for item metadata.
Audit installed plugins that manipulate item NBT to confirm they do not reintroduce unbounded meta values.
Restrict server access to trusted players via whitelisting until the patch is deployed.
Configure automated process supervision so that operators are alerted on repeated crash-restart cycles rather than masking them.

Patch Information

The fix is committed in PocketMine-MP commit c8e1cfc and shipped in release 4.2.3. Additional context is available in the GitHub Security Advisory GHSA-46c5-pfj8-fv65 and the VulnCheck Denial of Service Advisory.

Workarounds

Enable server whitelisting to limit inbound connections to known player accounts while planning the upgrade.
Deploy network-layer rate limiting on the Minecraft Bedrock port to slow repeated crash attempts from a single source.
Ban accounts and source addresses observed triggering crashes with malformed inventory packets.

bash

# Verify the running PocketMine-MP version and upgrade if below 4.2.3
php PocketMine-MP.phar --version

# Upgrade using the official installer script
curl -sL https://get.pmmp.io | bash -s - -v 4.2.3