---
id: CVE-2022-51010
title: >-
  PocketMine-MP versions before 4.4.2 fail to properly validate item IDs
  received from clients in itemstack NBT data
summary: >-
  PocketMine-MP versions before 4.4.2 fail to properly validate item IDs
  received from clients in itemstack NBT data. Attackers can send crafted item
  IDs outside the valid range to trigger an uncaught exception that crashes the
  server.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 4.4.2
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:59:42.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-51010'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00508
epssPercentile: 0.42408
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T13:23:59.387352Z'
ingestedAt: '2026-09-08T15:33:26.976Z'
---

## Overview

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.