CVE-2022-51015: PocketMine-MP DOS Vulnerability

CVE-2022-51015 Overview

CVE-2022-51015 affects PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition, in versions prior to 4.0.6. The server does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData, typically carried within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets containing invalid facing values, such as negative or out-of-range integers, to crash the server process. The result is a denial of service against the game server and any connected players. The vulnerability is classified under [CWE-20: Improper Input Validation].

Critical Impact
Any authenticated player can remotely crash a vulnerable PocketMine-MP server by sending a single malformed packet, interrupting service for all connected users.

Affected Products

PocketMine-MP versions prior to 4.0.6
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Plugins and hosted services depending on affected PocketMine-MP releases

Discovery Timeline

2026-09-07 - CVE-2022-51015 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2022-51015

Vulnerability Analysis

The defect lies in the client-to-server packet handling within InGamePacketHandler. PocketMine-MP accepts a facing integer field from clients when processing block-breaking actions and item-use transactions. The handler forwards this value into game logic without confirming it belongs to the expected set of valid facing directions defined by the Facing enum. Invalid values trigger unhandled exceptions or array lookup failures deeper in the block interaction code path. Because the exception propagates through the main server tick, the process terminates and disconnects every active session.

Root Cause

The root cause is missing input validation on untrusted client-supplied enumeration values. Fields carrying facing directions in PlayerActionPacket and UseItemTransactionData were treated as trusted before use. The Facing class exposes a limited valid range (0–5), but the packet handler did not enforce membership before dispatching downstream logic.

Attack Vector

Exploitation requires network access and a valid authenticated session on the target server. Once connected, an attacker sends a crafted PlayerActionPacket with action set to START_BREAK or CRACK_BREAK and a face value outside 0–5. Alternatively, a crafted InventoryTransactionPacket containing UseItemTransactionData with an invalid facing value achieves the same result. No additional privileges or user interaction are required.

php

 use pocketmine\item\WritableBook;
 use pocketmine\item\WritableBookPage;
 use pocketmine\item\WrittenBook;
+use pocketmine\math\Facing;
 use pocketmine\math\Vector3;
 use pocketmine\nbt\tag\CompoundTag;
 use pocketmine\nbt\tag\StringTag;

Source: PocketMine-MP commit f126479. The patch imports the Facing helper into InGamePacketHandler.php and adds validity checks on facing values received from clients before they are used in game logic.

Detection Methods for CVE-2022-51015

Indicators of Compromise

Sudden PocketMine-MP process termination coinciding with a single player's packet activity
Server logs containing unhandled exceptions referencing PlayerActionPacket, UseItemTransactionData, or InventoryTransactionPacket
Repeated crash-restart cycles shortly after a specific account authenticates
Stack traces originating from InGamePacketHandler with facing-related errors

Detection Strategies

Parse PocketMine-MP crash dumps for facing value exceptions and correlate to the offending session identifier
Enable verbose packet logging on non-production servers to capture malformed face fields in inbound traffic
Alert on abnormal disconnect storms following authentication of a single client

Monitoring Recommendations

Track server uptime and crash frequency as a leading indicator of exploitation attempts
Forward PocketMine-MP application logs to centralized logging for correlation across hosts
Monitor authenticated player join events immediately preceding server termination

How to Mitigate CVE-2022-51015

Immediate Actions Required

Upgrade PocketMine-MP to version 4.0.6 or later on all production and staging servers
Restrict server access to trusted allowlists where feasible until patching is complete
Review authentication and account provisioning to limit anonymous or throwaway sessions

Patch Information

The fix is delivered in PocketMine-MP 4.0.6 and tracked in commit f126479c37ff00a717a828f5271cf8e821d12d6c. See the GitHub Security Advisory GHSA-xh99-hw7h-wf63 and the VulnCheck Advisory for PocketMine-MP for additional detail.

Workarounds

Implement automated server watchdogs to restart PocketMine-MP after a crash and preserve stack traces for triage
Deploy plugin-level middleware that rejects PlayerActionPacket and InventoryTransactionPacket messages with facing values outside 0–5
Rate-limit or ban clients that trigger repeated packet-decoding exceptions

bash

# Upgrade PocketMine-MP to a fixed release
git clone https://github.com/pmmp/PocketMine-MP.git
cd PocketMine-MP
git checkout 4.0.6
composer install --no-dev