CVE-2024-58381: PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
Published Sep 9, 2026
·Updated
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
Affected Software
1 affected component
PocketMine PocketMine-MP<5.11.1
Event History
Sep 9, 2026
CVE Published
via MITRE·01:31 PM
Data Sourced
via MITRE·01:31 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need an account or any user interaction to exploit this issue?
No. The vulnerability is network-reachable and requires neither privileges nor user interaction, so an unauthenticated remote attacker can attempt exploitation.
2
How can I determine whether a server requires remediation?
Deployments running PocketMine-MP versions earlier than 5.11.1 are affected. Upgrade to 5.11.1 or later to address the issue.