EUVD-2022-56042

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51010

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data . An attacker with a low-privilege client can send a crafted item ID outside the valid range, triggering an uncaught exception that crashes the server, resulting in a high availabili...