Back to Database
Status published
High
CVE-2023-7332
PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crash
Vulnerability Description
PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid player session can request that the server drop more items than are available in the player's hotbar, triggering a server crash and resulting in denial of service.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7332
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv
- https://github.com/pmmp/PocketMine-MP/commit/5897476
- https://www.vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash
Affected Vendor
pmmp
View all reports →Affected Software
PocketMine-MP
Vulnerable Versions:
0
Timeline
Official Publish:
December 31st, 2025
Last Modified:
July 15th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.