GHSA-xh99-hw7h-wf63: Unchecked validity of Facing values in PlayerActionPacket

January 13, 2022 (updated December 26, 2025)

A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values (e.g. negative), specifically with START_BREAK or CRACK_BLOCK actions, or with a UseItemTransactionData (typically in InventoryTransactionPacket).

References

github.com/advisories/GHSA-xh99-hw7h-wf63
github.com/pmmp/PocketMine-MP
github.com/pmmp/PocketMine-MP/commit/f126479c37ff00a717a828f5271cf8e821d12d6c
github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xh99-hw7h-wf63

Code Behaviors & Features

Detect and mitigate GHSA-xh99-hw7h-wf63 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →