Description
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 4.0.6 | 4.0.6 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 4.0.6 | 4.0.6 | GHSA-xh99-hw7h-wf63 |
References
- GitHub Security Advisory (GHSA-xh99-hw7h-wf63) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket third-party-advisory