Description
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Published: 2026-09-09
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

PocketMine‑MP before version 5.11.1 contains a deserialization weakness in the LoginPacket JSON handler. An attacker can send malformed JSON data that causes improper object initialization and unset required properties, which in turn crashes the server. The flaw falls under the deserialization of untrusted data category.

Affected Systems

PocketMine‑MP servers running any version earlier than 5.11.1 are potentially impacted. Operators of community or private Minecraft PE servers using this software face the risk unless the server is updated.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. The likely attack vector is remote network traffic to the LoginPacket endpoint; an attacker only needs the ability to send packets on the server’s login port and does not require authentication or elevated privileges.

Generated by OpenCVE AI on September 9, 2026 at 15:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to PocketMine‑MP 5.11.1 or newer, which contains the LoginPacket JSON processing fix.
  • Restrict the server’s exposure by placing it behind a firewall or reverse proxy so that only trusted hosts can reach the login port.
  • Restart the server after applying the upgrade to ensure the new code is in use and to clear any stale crash conditions.

Generated by OpenCVE AI on September 9, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Title PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T13:31:55.512Z

Reserved: 2026-08-16T13:02:14.690Z

Link: CVE-2024-58381

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T14:17:10.187

Modified: 2026-09-09T14:17:10.187

Link: CVE-2024-58381

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T15:15:04Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data