CVE-2024-58381: PocketMine-MP DOS Vulnerability

CVE-2024-58381 Overview

CVE-2024-58381 is a denial of service vulnerability in PocketMine-MP versions before 5.11.1. The flaw resides in LoginPacket JSON processing, where the server improperly initializes objects from scalar JSON types. Remote attackers can send malformed JSON data to trigger unset required properties, crashing the server process. No authentication or user interaction is required to exploit this flaw. The underlying weakness is classified as [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated remote attackers can crash PocketMine-MP servers by sending a single crafted LoginPacket, disrupting Minecraft Bedrock server availability.

Affected Products

PocketMine-MP versions prior to 5.11.1
Deployments bundling pocketmine/netresearch-jsonmapper at version ~v4.2.1000
Minecraft Bedrock Edition servers running vulnerable PocketMine-MP builds

Discovery Timeline

2026-09-09 - CVE-2024-58381 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2024-58381

Vulnerability Analysis

PocketMine-MP relies on netresearch/jsonmapper to deserialize JSON payloads inside LoginPacket into typed PHP objects. The mapper accepted scalar JSON values (such as strings, integers, or booleans) where object types were expected. When this happened, the mapper produced object instances with required properties left unset.

Subsequent code paths accessed those uninitialized typed properties, triggering PHP Error exceptions that propagated up through the packet handler. Because the failure occurs during pre-authentication login processing, any remote client can send a crafted packet and terminate the server process.

Root Cause

The root cause is unsafe deserialization behavior in the bundled netresearch/jsonmapper dependency. The library did not reject scalar JSON inputs supplied for object-typed fields, so PocketMine-MP constructed partially initialized data transfer objects. Combined with PHP typed properties that throw when read before assignment, this allowed any malformed field in the login payload to translate directly into a server crash.

Attack Vector

Exploitation requires only network reachability to the Minecraft Bedrock server port. An attacker connects to the server and sends a LoginPacket in which one or more nested JSON objects are replaced with scalar values. The server attempts to map the payload, generates uninitialized property accesses, and terminates. Repeated packets keep the server offline, producing a persistent denial of service condition.

text

// Patch: composer.json — upgrade netresearch/jsonmapper pin
       "ext-zlib": ">=1.2.11",
       "composer-runtime-api": "^2.0",
       "adhocore/json-comment": "~1.2.0",
-      "pocketmine/netresearch-jsonmapper": "~v4.2.1000",
+      "pocketmine/netresearch-jsonmapper": "~v4.4.999",
       "pocketmine/bedrock-block-upgrade-schema": "~3.5.0+bedrock-1.20.60",
       "pocketmine/bedrock-data": "~2.8.0+bedrock-1.20.60",
       "pocketmine/bedrock-item-upgrade-schema": "~1.7.0+bedrock-1.20.60",
// Source: https://github.com/pmmp/PocketMine-MP/commit/6872661fd03649cc7a8762c41c16e9ee5a4de1c9

The fix bumps pocketmine/netresearch-jsonmapper from ~v4.2.1000 to ~v4.4.999, pulling in mapper hardening that rejects scalar-to-object coercion during login JSON handling.

Detection Methods for CVE-2024-58381

Indicators of Compromise

Unexpected PocketMine-MP process termination immediately after inbound client login attempts.
PHP fatal errors in server logs referencing typed property access on LoginPacket or JSON mapping classes.
Repeated short-lived connections from a single source IP followed by server restarts triggered by supervisor scripts.

Detection Strategies

Monitor PocketMine-MP crash-loop patterns and correlate them with inbound login packets from untrusted sources.
Inspect protocol-layer telemetry for LoginPacket payloads that contain scalar values where JSON objects are expected in the Bedrock login schema.
Track version banners exposed by PocketMine-MP servers and flag any instance reporting a build prior to 5.11.1.

Monitoring Recommendations

Alert on process supervisor events that restart the PocketMine-MP service more than a defined threshold per hour.
Forward PHP error logs to a centralized log platform and search for exceptions originating in JSON mapping code paths.
Baseline normal login packet sizes and structures, then alert on statistical outliers targeting the Bedrock listener port.

How to Mitigate CVE-2024-58381

Immediate Actions Required

Upgrade PocketMine-MP to version 5.11.1 or later across all production and staging servers.
Restrict public exposure of Minecraft Bedrock server ports to trusted networks or authenticated players where feasible.
Enable automatic process supervision and rate limits so isolated crash attempts do not translate into extended outages.

Patch Information

The vendor addressed the vulnerability by hardening JSON mapping for login handling. The dependency pocketmine/netresearch-jsonmapper was upgraded from ~v4.2.1000 to ~v4.4.999. Refer to the GitHub Security Advisory GHSA-h6j3-j35f-v2x7, the primary patch commit, the follow-up commit, and the VulnCheck advisory for full details.

Workarounds

Place the server behind a proxy or firewall that only allows connections from known player IP ranges until patching completes.
Deploy a supervisor such as systemd with restart back-off and rate limiting to reduce impact from repeated crash attempts.
Disable public server listings so opportunistic scanners cannot discover the vulnerable instance from server browser services.

bash

# Upgrade PocketMine-MP via Composer to a fixed release
composer require pocketmine/pocketmine-mp:^5.11.1
composer update pocketmine/netresearch-jsonmapper

# Verify installed version
php PocketMine-MP.phar --version