CVE-2021-48007— PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
Quick assessment
Affected
pmmp PocketMine-MP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PocketMine-MP 在 3.18.1 之前的版本未能对 MovePlayerPacket 中 position 和 rotation 字段的 NaN 或 INF 值进行校验。恶意客户端可以发送包含非法浮点数值（如 NaN 或 INF）的移动数据包，从而通过未处理的数学运算导致服务器崩溃，或阻止客户端渲染其他玩家。
Possible ATT&CK Techniques 1 AI
T1072 · Software Deployment ToolsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pmmp | PocketMine-MP | < 3.18.1 |
affected |
3.18.1 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-48007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
Source: CVE Program / CVE List V5
Vulnerability Description
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pmmp | PocketMine-MP | 0 ~ 3.18.1 | - |
|
II. Public POCs for CVE-2021-48007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-48007
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-48007 (1)
Vendor Advisories for CVE-2021-48007 (2)
Same Patch Batch · pmmp · 2026-09-06 · 5 CVEs total
| CVE-2022-51009 | 7.5 HIGH | PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry |
| CVE-2020-37277 | 6.5 MEDIUM | PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction |
| CVE-2022-51008 | 5.3 MEDIUM | PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions |
| CVE-2021-48006 | 3.3 LOW | PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity |
IV. Related Vulnerabilities
Same product: PocketMine-MP
-
CVE-2022-51009
PocketMine-MP before 4.7.2 Denial of Service via Skin Geomet -
CVE-2022-51008
PocketMine-MP before 4.12.3 Denial of Service via Unauthenti -
CVE-2021-48006
PocketMine-MP before 4.0.3 Operator Privilege Escalation via -
CVE-2020-37277
PocketMine-MP before 3.15.4 Denial of Service via InventoryT -
CVE-2023-7332
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item C
Same vendor: pmmp
-
CVE-2022-51009
PocketMine-MP before 4.7.2 Denial of Service via Skin Geomet -
CVE-2022-51008
PocketMine-MP before 4.12.3 Denial of Service via Unauthenti -
CVE-2021-48006
PocketMine-MP before 4.0.3 Operator Privilege Escalation via -
CVE-2020-37277
PocketMine-MP before 3.15.4 Denial of Service via InventoryT -
CVE-2023-7332
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item C
Same weakness: CWE-20
-
CVE-2026-50553
Note Mark: Path traversal via unsanitized book/note slug in -
CVE-2026-84947
undici vulnerable to response truncation via oversized chunk -
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped -
CVE-2026-84504
fastify vulnerable to request body replacement via an async -
CVE-2026-85528
Snowflake JDBC Driver auto-configuration account validation
V. Comments for CVE-2021-48007
No comments yet