CVE-2024-58381CWE-502insecure-deserialization

CVE-2024-58381

High · published September 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-09T18:17Z
References (4)
https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9 · [email protected]https://github.com/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7 · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7 · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-loginpacket · [email protected]
EPSS history
Timeline
  • 11 SEP 03:14Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:31Z
    PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
    cvelistv5