Description

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:21.510Z",
  "pubdate": "2026-09-07T13:17:21.510Z",
  "executiveSummary": "PocketMine-MP versions prior to 4.4.2 contain a critical vulnerability stemming from insufficient validation of item IDs within itemstack NBT (Named Binary Tag) data. This flaw allows remote, unauthenticated attackers to supply malformed or out-of-range item identifiers during the server-client synchronization process. The primary security impact is a denial-of-service (DoS) condition, wherein the server fails to handle the unexpected data, resulting in an uncaught exception that abruptly terminates the server process. This vulnerability poses a significant risk to service availability, as it requires minimal effort for an attacker to initiate a server-wide crash. No special privileges are required, and the exploit can be delivered via the standard network protocol used by the game client, effectively bypassing basic sanity checks.",
  "technicalDetails": "The vulnerability resides within the packet handling subsystem of PocketMine-MP, specifically in the logic responsible for parsing and deserializing itemstack NBT data received from connected clients. During the standard game state synchronization process, the client transmits an inventory update or item-related packet containing a nested NBT structure that defines the properties of the item, including its internal numerical identifier.\nThe root cause is an improper bounds-checking mechanism during the deserialization of the item ID field. While the server expects an integer value corresponding to a defined item type within the game's registry, the validation logic fails to verify if the provided ID falls within the permissible range of registered items. When an attacker crafts a malicious packet containing an out-of-range integer, the server's internal object mapping or type-retrieval function attempts to process the invalid identifier. Because the code assumes that the ID will always resolve to a valid instance, it lacks the necessary exception handling or safety checks to manage non-existent or undefined IDs.\nThe attack flow follows these steps: 1) The attacker initiates a connection to the PocketMine-MP server. 2) The attacker intercepts or modifies outgoing client packets to inject an itemstack NBT structure with an arbitrary, out-of-range item ID. 3) The server receives the packet and passes the NBT data to the deserialization routine. 4) The routine attempts to construct an Item instance using the malicious ID. 5) An uncaught exception (typically a runtime error due to null pointer dereference or index-out-of-bounds) is thrown because the server fails to locate the item in its registry. 6) Since the server lacks a high-level exception handler to gracefully catch this error during the packet processing loop, the thread encounters a fatal error, leading to an immediate server crash.\nThis vulnerability is triggered through the network layer, specifically affecting the protocol implementation. Because the crash occurs before any complex business logic is executed, it is highly resilient against common application-level protections. Successful exploitation forces a process restart, causing service downtime for all players connected to the instance. This confirms that the affected component is the item serialization/deserialization logic, specifically targeting the transition between untrusted client input and trusted server-side object state."
}