CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381

PocketMine-MP before 5.11.1 is vulnerable to a denial of service in its LoginPacket JSON processing . A remote attacker can crash the server by sending malformed JSON data, exploiting improper object initialization from scalar JSON types that triggers unset required properties. The vulnerability ...

EUVD-2024-55754

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58380 PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2024-58380

PocketMine-MP versions before 5.11.2 are affected by a denial of service vulnerability in BookEditPacket handling. An attacker with low privileges can send a crafted BookEditPacket containing an inventory slot value greater than 35 , triggering an unhandled exception that crashes the server . The...

EUVD-2023-60626

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...

CVE-2024-58380 PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

EUVD-2024-55753

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2024-58380 PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception...

CVE-2023-54395

PocketMine-MP versions before 4.12.5 are vulnerable to a denial of service via ModalFormResponsePacket processing. An attacker with low privileges can send numerous oversized JSON payloads in modal form response packets to consume server CPU time , exhausting resources and preventing the server f...

CVE-2023-54395 PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

CVE-2023-54395 PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

EUVD-2023-60625

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

CVE-2023-54395 PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...

EUVD-2023-60623

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54394 PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in the LoginPacket JSON parsing logic, caused by improper validation in the JsonMapper dependency. An unauthenticated attacker can send malformed JSON structures within a LoginPacket to crash the server . The CVSS v3.1...

EUVD-2023-60624

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...