CVE-2022-51015

PocketMine-MP before 4.0.6 fails to validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) and in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negati...