Description
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 3.18.1 | 3.18.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 3.18.1 | 3.18.1 | GHSA-fm35-jgg3-3grx |
References
- GitHub Security Advisory (GHSA-fm35-jgg3-3grx) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket third-party-advisory