Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2024-58380PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

Medium 6.5

In plain English

A medium-severity improper input validation in PocketMine-MP from pmmp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pocketmine/pocketmine-mp	5.11.2	GHSA-xc7j-wj36-qjfr

Affected products (as reported)

Vendor	Product	Versions
pmmp	PocketMine-MP	0 – before 5.11.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-xc7j-wj36-qjfr) vendor-advisory
Patch Commit patch
VulnCheck Advisory: PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket third-party-advisory