CVE-2024-41565

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-28 · updated 2026-06-17
Weakness: CWE-129

Description

JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index in JEI for Minecraft, which allows in-game item duplication.

Affected products

Mezz Justenoughitems: before 11.6.0.1021; from 12.0.0 before 13.1.0.18; from 14.0.0 before 15.8.0.11; from 16.0.0 before 19.5.0.34 — fixed in 11.6.0.1021, 13.1.0.18, 15.8.0.11, 19.5.0.34

How to fix

Upgrade to a fixed version: Mezz Justenoughitems 11.6.0.1021, 13.1.0.18, 15.8.0.11, 19.5.0.34. Check the vendor advisory for mitigations.

References

https://gist.github.com/apple502j/05123abb1d1c89c31afde15a9b34e2ae
https://github.com/mezz/JustEnoughItems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873

Get alerted when CVE-2024-41565 or the next vulnerability affects your stack