CyberRota Analysis
AI-GeneratedPocketMine-MP versions prior to 4.0.6 are vulnerable due to insufficient validation of facing values in PlayerActionPacket and UseItemTransactionData, allowing remote authenticated attackers to exploit this flaw. By sending specially crafted packets with invalid values, an attacker can crash the server, leading to a denial of service. Server administrators using affected versions should prioritize applying the update to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.