CVE-2024-58381
highPocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendi…
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-09 14:17
Modified: 2026-10-27 18:10
NVD status: Deferred
Last synced 19 hours ago
Verified against the source API 2026-10-28 11:30 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9 disclosure@vulncheck.com
- https://github.com/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7 disclosure@vulncheck.com
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-log... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 11:30 UTC · record ↗