CVE-2024-58380: Pmmp Pocketmine-Mp

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.

Affected products

• Pmmp Pocketmine-Mp: before 5.11.2 (fixed in 5.11.2)

Published 2026-09-09. Last modified 2026-10-08.