Impact A remote attacker may crash a server by sending "PlayerActionPacket" with invalid facing values (e.g. negative), specifically with "START_BREAK" or "CRACK_BLOCK" actions, or with a "UseItemTransactionData" (typically in "InventoryTransactionPacket"). Patches f126479c37ff00a717a828f5271cf8e821d12d6c Workarounds Using a plugin, cancel "DataPacketReceiveEvent" if the packet is "PlayerActionPacket" and the facing is outside the range 0-5 when receiving START_BREAK or CRACK_BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases. For more information If you have any questions or comments about this advisory: * Email us at "team@pmmp.io" (mailto:team@pmmp.io)