CVE-2024-58381

PocketMine-MP before 5.11.1 contains a denial-of-service flaw (CWE-502, deserialization of untrusted data) in how it processes the JSON payload of the Minecraft login packet. A remote, unauthenticated attacker can connect to the server's Bedrock protocol port and send malformed JSON in which scalar values are used where objects are expected, causing improper object initialization that leaves required properties unset. The resulting fault crashes the server, giving the attacker denial of service only — the CVSS 4.0 vector shows high availability impact with no confidentiality or integrity impact, and no code execution is indicated. Anyone operating a Minecraft: Bedrock Edition multiplayer server with PocketMine-MP prior to 5.11.1 is affected, including community, hosted, and private deployments exposed to the internet or shared networks. The vulnerability is not in CISA KEV and no public proof-of-concept is known, so exploitation is not confirmed, but the flaw is trivially reachable pre-authentication and patching should be treated as urgent.

What to do: Upgrade PocketMine-MP to 5.11.1 or later, which is the earliest version with the fix. Check your deployed version from server startup logs or the version output before upgrading, and if upgrading is delayed, limit exposure of the Bedrock query/protocol ports to trusted networks and monitor for crash loops. After patching, verify the fix by confirming servers survive unexpected or truncated login payloads.