CVE-2024-58381 json
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
published 2024-03-06 2 y ago modified 2026-10-27 12 d ago also GHSA-h6j3-j35f-v2x7 , EUVD-2024-55754
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Patch / fix
- packagist pocketmine/pocketmine-mp 5.11.1
- pmmp PocketMine-MP 5.11.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 56 d ago
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pocketmine/pocketmine-mp | <5.11.1 |
5.11.1 |
Affected products
- pmmp PocketMine-MP
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7
patch
-
github.com
/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9
patch, web
-
github.com
/cweiske/jsonmapper/pull/225
web
-
github.com
/pmmp/netresearch-jsonmapper/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7
web
-
github.com
/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7
vendor-advisory, web
-
vulncheck.com
/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-loginpacket
third-party-advisory
-
github.com
/cweiske/jsonmapper/issues/226
web
-
github.com
/pmmp/PocketMine-MP
package
Sources
- CVE List CVE-2024-58381
- GitHub Advisory GHSA-h6j3-j35f-v2x7
- NVD CVE-2024-58381
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.