CVE-2024-58380: PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.11.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the server and low-level privileges, as reflected by the PR:L vector. No user interaction is required.
What packet value triggers the crash?
A crafted BookEditPacket with an inventory slot value greater than 35 can cause an unhandled exception and crash the server.
Are versions 5.11.2 and later affected?
The issue affects PocketMine-MP versions before 5.11.2. Version 5.11.2 is not identified as affected by the provided data.