Summary
PocketMine-MP server crash with certain invalid JSON payloads in LoginPacket due to dependency vulnerability (3rd time)
Workarounds
Detecting the malicious data that triggers this issue is of rather high difficulty, so it's not likely that a plugin would be able to easily remediate this.
References
https://github.com/cweiske/jsonmapper/pull/225
https://github.com/cweiske/jsonmapper/issues/226
Impact
An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.
netresearch/jsonmapper allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to objects whose constructors don't handle the input values.
Code handling these objects in PocketMine-MP could then crash due to @required properties not being set within the objects.
In addition, because JsonMapper does not respect bStrictObjectTypes when processing arrays, it's not possible to avoid the issue by disabling the feature.
Due to the relatively high number of security issues arising from unexpected behaviour in JsonMapper, the team is exploring options to replace it.
GHSA-H6J3-J35F-V2X7 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.11.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
In the meantime, the issue was fixed by pmmp/netresearch-jsonmapper@b96a209f9e8b76b899a0d0918493cd87eb3c02a7 and 6872661fd03649cc7a8762c41c16e9ee5a4de1c9.
Frequently Asked Questions
- What is GHSA-H6J3-J35F-V2X7? GHSA-H6J3-J35F-V2X7 is a high-severity security vulnerability in pocketmine/pocketmine-mp (composer), affecting versions < 5.11.1. It is fixed in 5.11.1.
- How severe is GHSA-H6J3-J35F-V2X7? GHSA-H6J3-J35F-V2X7 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of pocketmine/pocketmine-mp are affected by GHSA-H6J3-J35F-V2X7? pocketmine/pocketmine-mp (composer) versions < 5.11.1 is affected.
- Is there a fix for GHSA-H6J3-J35F-V2X7? Yes. GHSA-H6J3-J35F-V2X7 is fixed in 5.11.1. Upgrade to this version or later.
- Is GHSA-H6J3-J35F-V2X7 exploitable, and should I be worried? Whether GHSA-H6J3-J35F-V2X7 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-H6J3-J35F-V2X7 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-H6J3-J35F-V2X7? Upgrade
pocketmine/pocketmine-mpto 5.11.1 or later.