---
id: CVE-2024-58381
title: >-
  PocketMine-MP before 5.11.1 contains a denial of service vulnerability in
  LoginPacket JSON processing that allows remote attackers to crash the server
  by sending malformed JSON data
summary: >-
  PocketMine-MP before 5.11.1 contains a denial of service vulnerability in
  LoginPacket JSON processing that allows remote attackers to crash the server
  by sending malformed JSON data. Attackers can exploit improper object
  initialization f…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-502
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 5.11.1
published: '2026-09-09'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T14:17:07.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58381'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/b96a209f9e8b76b899a0d0918493cd87eb3c02a7
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6j3-j35f-v2x7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-5.11.1-denial-of-service-via-loginpacket
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T13:16:22.332115Z'
epss: 0.00431
epssPercentile: 0.34755
ingestedAt: '2026-09-14T15:23:07.419Z'
---

## Overview

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.