CVE-2024-58381

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.11.1

Description A denial of service issue exists in the processing of JSON data within the LoginPacket. Remote attackers can crash the server by sending malformed JSON data. The flaw stems from the netresearch/jsonmapper component, which allows objects to be hydrated from scalar JSON types. Due to a lack of validation, this can result in improperly initialized objects where required properties are not set, leading to an application crash when the code attempts to access these properties. This behavior occurs even if bStrictObjectTypes is disabled, as the component does not respect this setting when processing arrays.

Recommendations Update to version 5.11.1 or later.