Vulnerability · Published Sep 6, 2026 · Assigned by VulnCheck

CVE-2021-48007PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

Medium 6.5

In plain English

A medium-severity improper input validation in PocketMine-MP from pmmp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pocketmine/pocketmine-mp	3.18.1	GHSA-fm35-jgg3-3grx

Affected products (as reported)

Vendor	Product	Versions
pmmp	PocketMine-MP	0 – before 3.18.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-fm35-jgg3-3grx) vendor-advisory
Patch Commit patch
VulnCheck Advisory: PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket third-party-advisory