Description
PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pmmp | PocketMine-MP | < 5.11.2 | 5.11.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pocketmine/pocketmine-mp | < 5.11.2 | 5.11.2 | GHSA-xc7j-wj36-qjfr |
References
- GitHub Security Advisory (GHSA-xc7j-wj36-qjfr) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket third-party-advisory