Every CVE Search/ Get API key

CVE-2021-48007

PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

7.1 HighFix available

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.53%Up 0.2 points since Sep 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Record
CVE-2021-48007
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2021-34877 7.1

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Record
EUVD-2021-34877
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-556r-f58w-q4pf 7.1

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket...

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Record
GHSA-556r-f58w-q4pf
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
GitHub AdvisoriesGHSA-fm35-jgg3-3grx 7.5

NaN/INF in serverbound movement packets can crash clients and servers

Impact

A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.

  • The server may crash in various ways if this exploit is used, because some mathematical operations on NaN/INF generate PHP warnings, which are converted into exceptions.
  • Clients may not be able to see other clients who have a NaN/INF rotation.
  • Clients may also crash in such cases.

Patches

A patch for this was included in the 3.18.1 release: https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638

Workarounds

Workarounds could be implemented as plugins using DataPacketReceiveEvent to block any inbound movement packets containing bogus values.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-fm35-jgg3-3grx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 7.1

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Record
CVE-2021-48007
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 7.1

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Record
CVE-2021-48007
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-fm35-jgg3-3grx 7.5

NaN/INF in serverbound movement packets can crash clients and servers

Impact

A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.

  • The server may crash in various ways if this exploit is used, because some mathematical operations on NaN/INF generate PHP warnings, which are converted into exceptions.
  • Clients may not be able to see other clients who have a NaN/INF rotation.
  • Clients may also crash in such cases.

Patches

A patch for this was included in the 3.18.1 release: https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638

Workarounds

Workarounds could be implemented as plugins using DataPacketReceiveEvent to block any inbound movement packets containing bogus values.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-fm35-jgg3-3grx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pocketmine/pocketmine-mp
Packagist
 through 3.18.0
3.18.1
pocketmine/pocketmine-mp
Packagist
 before 3.18.1, plus listed versions
3.0.03.0.13.0.103.0.113.0.12
Show 45 moreShow less
3.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.1.83.10.03.10.13.11.03.11.13.11.23.11.33.11.43.11.53.11.63.11.73.12.03.12.13.12.23.12.33.12.43.12.53.12.63.13.03.13.13.14.03.14.13.14.23.14.33.15.03.15.13.15.23.15.33.15.4
3.18.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-48007 is a high vulnerability (CVSS 7.1) in Pmmp Pocketmine-mp, published March 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in pocketmine/pocketmine-mp 3.18.1.

References

This page doesn't list everything

Left out here: 70 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open