CVE-2024-58380

PocketMine-MP, a popular PHP-based server implementation for Minecraft: Bedrock Edition, fails to validate input in its BookEditPacket handler, allowing an invalid inventory slot value to trigger an unhandled exception. An attacker with player-level network access to a vulnerable server can send a crafted BookEditPacket whose inventory slot value exceeds 35, crashing the entire game server process. The impact is complete availability loss: every connected player is disconnected, and the attack can be repeated continuously for a sustained denial of service. Any operator running PocketMine-MP in a version before 5.11.2 is affected, with internet-facing or publicly joinable servers most at risk. The issue is not in CISA's KEV catalog and no public proof-of-concept is known, so active exploitation has not been confirmed.

What to do: Upgrade PocketMine-MP to version 5.11.2 or later, which validates the BookEditPacket slot value. Until patched, limit exposure by whitelisting players, restricting join access on public servers, and monitoring for repeated crashes. Verify current running version in server logs or the version file, as plugin and wrapper deployments may lag the installed core version.