CVE-2024-58380: PocketMine-MP BookEditPacket DoS Vulnerability

CVE-2024-58380 Overview

CVE-2024-58380 is a denial of service vulnerability in PocketMine-MP versions before 5.11.2. The flaw resides in the handleBookEdit function within the InGamePacketHandler class. An authenticated player can send a crafted BookEditPacket with an inventorySlot value greater than 35, which exceeds the valid inventory slot range. The server fails to validate the slot value before passing it to getItem(), triggering an unhandled exception that crashes the server process. The vulnerability is classified as improper input validation [CWE-20].

Critical Impact
A low-privileged remote player can crash a PocketMine-MP server by sending a single malformed BookEditPacket, disrupting availability for all connected users.

Affected Products

PocketMine-MP versions prior to 5.11.2
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Server networks deploying the affected packet handler

Discovery Timeline

2026-09-09 - CVE-2024-58380 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2024-58380

Vulnerability Analysis

The vulnerability exists in the handleBookEdit method of src/network/mcpe/handler/InGamePacketHandler.php. The handler processes incoming BookEditPacket messages from connected players and reads the inventorySlot field directly. It then calls $this->player->getInventory()->getItem($packet->inventorySlot) without first checking whether the slot index falls within the inventory's valid range. Player inventories in Minecraft: Bedrock Edition contain 36 slots indexed from 0 to 35. Supplying an index outside this range causes getItem() to raise an exception. Because the exception is unhandled at the packet-handler level, it propagates up and terminates the server process, ending the session for every connected player.

Root Cause

The root cause is missing input validation on attacker-controlled packet fields. The handler trusts the client-supplied slot index and dereferences the inventory without confirming the index exists. This is a textbook improper input validation defect [CWE-20] on a network-reachable code path.

Attack Vector

Exploitation requires an authenticated session on the target server but does not require elevated privileges or user interaction. An attacker joins the server as a normal player and transmits a single BookEditPacket with an inventorySlot value greater than 35. The server crashes immediately upon processing the packet.

php

 	}
 
 	public function handleBookEdit(BookEditPacket $packet) : bool{
+		$inventory = $this->player->getInventory();
+		if(!$inventory->slotExists($packet->inventorySlot)){
+			return false;
+		}
 		//TODO: break this up into book API things
-		$oldBook = $this->player->getInventory()->getItem($packet->inventorySlot);
+		$oldBook = $inventory->getItem($packet->inventorySlot);
 		if(!($oldBook instanceof WritableBook)){
 			return false;
 		}

Source: PocketMine-MP commit 47f0119. The patch introduces an slotExists() guard that returns early if the supplied inventory slot is invalid, preventing the exception from being raised.

Detection Methods for CVE-2024-58380

Indicators of Compromise

Abrupt PocketMine-MP process termination shortly after a player join event.
Server logs containing unhandled exceptions originating from handleBookEdit or getItem() in InGamePacketHandler.php.
Repeated crash-restart cycles correlating with the same player account or source IP.

Detection Strategies

Parse PocketMine-MP crash dumps for stack traces referencing handleBookEdit and inventory slot access.
Alert on BookEditPacket messages where the inventorySlot field exceeds 35 at network inspection points that can decode the Bedrock protocol.
Correlate player session identifiers with server termination events to attribute crashes to specific accounts.

Monitoring Recommendations

Track server uptime and restart frequency as a leading indicator of exploitation attempts.
Forward PocketMine-MP application logs and crash reports to a centralized logging pipeline for retention and query.
Monitor authentication logs for accounts that join immediately before recurring crashes.

How to Mitigate CVE-2024-58380

Immediate Actions Required

Upgrade PocketMine-MP to version 5.11.2 or later on all production and staging servers.
Restrict server access to trusted players until the patch is deployed.
Enable automated crash recovery so that exploitation attempts cause minimal downtime while patching proceeds.

Patch Information

The fix is committed to the PocketMine-MP repository in commit 47f0119 and shipped in release 5.11.2. The patch adds a slotExists() check on the incoming inventorySlot before calling getItem(), returning false from the handler when the index is out of range. Review the GitHub Security Advisory GHSA-xc7j-wj36-qjfr and the VulnCheck advisory for additional context.

Workarounds

Apply the patch from commit 47f0119 manually to InGamePacketHandler.php if an immediate upgrade is not feasible.
Deploy a plugin or middleware that drops BookEditPacket messages with inventorySlot values greater than 35 before they reach the core handler.
Enforce allowlists on which accounts may connect to public-facing servers to reduce attacker reach.

bash

# Upgrade PocketMine-MP to the patched release
composer require pocketmine/pocketmine-mp:^5.11.2

# Or pull the fixed release directly
wget https://github.com/pmmp/PocketMine-MP/releases/download/5.11.2/PocketMine-MP.phar