Description

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T13:17:23.173Z",
  "pubdate": "2026-09-07T13:17:23.173Z",
  "executiveSummary": "PocketMine-MP versions prior to 4.2.3 contain an improper input validation vulnerability within the processing of item NBT (Named Binary Tag) data.\nThe vulnerability resides in the server's failure to sanitize damage metadata values provided by the client for tool and armor items.\nBy submitting malicious NBT payloads containing negative or out-of-range integer values, an attacker can trigger unhandled exceptions within the Durable class, leading to a denial-of-service (DoS) condition via server process termination.\nThis vulnerability is highly accessible as it does not require administrative privileges, merely the ability to interact with the game server protocol. Successful exploitation results in the immediate crash of the server instance, impacting availability for all connected users.\nThe risk is categorized as high for production environments where service uptime is critical, as the attack vector is trivial to execute by any connected client capable of crafting custom packet payloads.",
  "technicalDetails": "The root cause of this vulnerability is an absence of range validation for damage metadata encapsulated within the NBT data of tool and armor items received from client packets. PocketMine-MP's item handling logic deserializes item metadata directly from client-supplied NBT structures without enforcing constraints on the integrity of the numerical values.\nThe vulnerability specifically manifests within the Durable class, which is responsible for managing item durability and state. When the server processes an itemstack, it passes the damage metadata to internal methods that anticipate specific, valid ranges. When an attacker supplies a negative value or an out-of-range integer that exceeds the expected boundaries of the item's durability, the Durable class operations fail to account for these edge cases.\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious packet containing an Itemstack definition. Within the NBT tag associated with the item, the attacker manipulates the 'damage' field to contain an invalid, non-standard integer value. Second, this packet is transmitted to the server over the standard game protocol during inventory interaction or item placement. Third, the server's networking layer parses the packet and passes the NBT data to the item deserialization routines. Fourth, the deserializer instantiates the item, passing the malformed damage data to the Durable component. Finally, the Durable component attempts to process this value, resulting in an unhandled exception (e.g., an OutOfBounds or unexpected logic error).\nBecause the exception is unhandled within the specific execution thread processing the network packet, the server's main loop or the session-specific thread crashes. This forces the server process to terminate, resulting in a persistent Denial of Service. There are no specialized privilege requirements for this exploit, as the server must process incoming item data from any authenticated client as part of standard gameplay. The attack is effective against all versions of PocketMine-MP prior to 4.2.3."
}