{"id":"CVE-2024-41565","details":"JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index in JEI for Minecraft, which allows in-game item duplication.","modified":"2026-08-12T15:15:30.517381Z","published":"2024-08-28T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41565.json"},"references":[{"type":"WEB","url":"https://gist.github.com/apple502j/05123abb1d1c89c31afde15a9b34e2ae"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41565.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41565"},{"type":"FIX","url":"https://github.com/mezz/JustEnoughItems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mezz/justenoughitems","events":[{"introduced":"0"},{"fixed":"99ff43ba1009c44c6d935e2ab8a6c9292bb12873"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v19.5.0","v19.4.1","v19.4.0","v19.3.1","v19.3.0","v19.2.0","v19.1.1","v19.1.0","v19.0.0","v18.0.0","v16.0.0","v17.3.0","v17.2.0","v17.1.0","v17.0.0","v15.1.0","v15.0.0","v14.0.0","v13.0.0","v12.3.0","v12.2.0","v12.1.1","v12.1.0","v12.0.2","v12.0.1","v12.0.0","v11.5.0","v11.4.0","v11.3.0","v11.2.3","v11.2.2","v11.2.1","v11.2.0","v11.1.1","v11.1.0","v10.1.0","v11.0.0","v9.7.0","v9.6.0","v9.5.5","v9.5.4","v9.5.3","v9.5.2","v9.5.1","v9.5.0","v9.4.3","v9.4.2","v9.4.1","v9.4.0","v9.3.3","v9.3.2","v9.3.1","v9.3.0","v9.2.3","v9.2.2","v9.2.1","v9.2.0","v9.1.2","v9.1.0","v9.0.0","v8.2.0","v8.1.0","v7.7.0","v7.6.4","v7.6.3","v7.6.2","v7.6.0","v7.5.0","v7.4.0","v7.3.2","v7.3.1","v7.3.0","v7.2.0","v7.1.1","v7.1.0","v7.0.1","v7.0.0","v6.0.2","v6.0.1","v6.0.0","v5.0.0","v4.14.3","v4.14.2","v4.14.1","v4.14.0","v4.13.1","v4.13.0","v4.12.1","v4.12.0","v4.11.0","v4.10.0","v4.9.2","v4.9.1","v4.9.0","v4.8.6","v4.8.5","v4.8.4","v4.8.3","v4.8.2","v4.8.1","v4.8.0","v4.7.11","v4.7.10","v4.7.9","v4.7.7","v4.7.6","v4.7.5","v4.7.4","v4.7.3","v4.7.2","v4.7.1","v4.7.0","v4.6.0","v4.5.0","v4.4.1","v4.4.0","v4.3.5","v4.3.4","v4.3.3","v4.3.2","v4.3.1","v4.3.0","v4.2.11","v4.2.10","v4.2.9","v4.2.8","v4.2.7","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.1","v4.1.0","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.13.2","v3.13.1","v3.13.0","v3.12.8","v3.12.7","v3.12.6","v3.12.5","v3.12.4","v3.12.3","v3.12.2","v3.12.1","v3.12.0","v3.11.2","v3.11.1","v3.11.0","v3.10.0","v3.9.7","v3.9.6","v3.9.5","v3.9.4","v3.9.3","v3.9.2","v3.9.1","v3.9.0","v3.8.1","v3.8.0","v3.7.12","v3.7.11","v3.7.10","v3.7.9","v3.7.8","v3.7.7","v3.7.6","v3.7.5","v3.7.4","v3.6.7","v3.7.3","v3.7.2","v3.7.1","v3.7.0","v3.6.6","v3.6.5","v3.6.4","v3.6.3","v3.6.2","v3.6.1","v3.6.0","v3.5.0","v3.4.4","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.14","v3.2.13","v3.2.12","v3.2.11","v3.2.10","v3.2.9","v3.2.8","v3.2.7","v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.2","v3.1.1","v3.1.0","v3.0.6","v3.0.5","v3.0.4","v2.28.7","v3.0.3","v3.0.2","v3.0.1","v2.28.6","v2.28.5","v2.28.4","v2.28.3","v2.28.2","v2.28.1","v2.28.0","v2.27.2","v2.27.1","v2.27.0","v2.26.2","v2.26.1","v2.26.0","v2.25.12","v2.25.11","v2.25.10","v2.25.9","v2.25.8","v2.25.7","v2.25.6","v2.25.4","v2.25.3","v2.25.2","v2.24.6","v2.24.5","v2.24.3","v2.24.2","v2.24.1","v2.24.0","v2.23.0","v2.22.5","v2.22.4","v2.22.3","v2.22.2","v2.22.1","v2.22.0","v2.21.2","v2.21.1","v2.21.0","v2.20.0","v2.19.1","v2.19.0","v2.18.1","v2.18.0","v2.17.4","v2.17.3","v2.17.2","v2.17.1","v2.17.0","v2.16.2","v2.16.1","v2.16.0","v2.15.3","v2.15.1","v2.15.0","v2.13.7","v2.13.6","v2.13.5","v2.13.4","v2.13.3","v2.13.2","v2.13.1","v2.13.0","v2.12.0","v2.11.3","v2.11.2","v2.11.1","v2.11.0","v2.10.0","v2.9.0","v2.8.3","v2.8.2","v2.8.1","v2.8.0","v2.7.1","v2.7.0","v2.6.0","v2.5.0","v2.4.0","v2.3.1","v2.3.0","v2.2.0","v2.1.2","v2.1.1","v2.1.0","v2.0.5","v2.0.4","v2.0.1","v2.0.0","v1.0.1","1.0.0","master"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41565.json","vanir_signatures_modified":"2026-08-12T15:15:30Z","vanir_signatures":[{"id":"CVE-2024-41565-1366c7df","signature_type":"Function","signature_version":"v1","source":"https://github.com/mezz/justenoughitems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873","target":{"file":"Library/src/main/java/mezz/jei/library/transfer/BasicRecipeTransferHandler.java","function":"validateTransferInfo"},"deprecated":false,"digest":{"length":944,"function_hash":"139075671416167560497422825868500660645"}},{"deprecated":false,"digest":{"line_hashes":["64638116533842271186437105336563330868","258545906205252646953459496764257587685","22772002143798030113740841479337640863","308616881519038832017620919144046755437","330736821890315639482409423242225526697","195335014405976081204418852556670178642","139749120511938806155506232889468793379","109785682982473013541029620905834762673","314463206564579037089402072640751709717","334224420811707771680163967498377259126","329854483777991570707756436727656206042"],"threshold":0.9},"id":"CVE-2024-41565-3f27008d","signature_type":"Line","signature_version":"v1","source":"https://github.com/mezz/justenoughitems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873","target":{"file":"Library/src/main/java/mezz/jei/library/transfer/BasicRecipeTransferHandler.java"}},{"digest":{"length":2045,"function_hash":"222118353219657740684920168508826673975"},"id":"CVE-2024-41565-633560dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/mezz/justenoughitems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873","target":{"file":"Common/src/main/java/mezz/jei/common/transfer/RecipeTransferUtil.java","function":"validateSlots"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mezz/justenoughitems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873","target":{"file":"Common/src/main/java/mezz/jei/common/transfer/RecipeTransferUtil.java"},"deprecated":false,"digest":{"line_hashes":["53452022447028492126424333934468179811","228280522535520801538458273273438214704","325369583994627017027025835338081383979","253241923519713398029451084506550787508","114609910570304169086324333339647750438","78361390426723727272231735978058026859","108699019692621251849030794248252024461","308333458648876903901379379467233485915","275507883430896333478174264659233906778","173522294937989001604777719013274093615","278855902752784711062284317593968676907","217017203451249455976462609121249028936","71277849326886971253142545288918845099","10813749927537190033728352827415872298","223085950647797279604513254730476531014","46132555802532563144921998227903361157","321167073266407604059152874877848152842","113078298198000188015652373099435516864","240522512309630831697827857464120036961","63023319149774050960125992398873200987","240337343017194005421661661502502705638"],"threshold":0.9},"id":"CVE-2024-41565-cb0a3dc0"},{"source":"https://github.com/mezz/justenoughitems/commit/99ff43ba1009c44c6d935e2ab8a6c9292bb12873","target":{"file":"Library/src/main/java/mezz/jei/library/transfer/BasicRecipeTransferHandler.java","function":"transferRecipe"},"deprecated":false,"digest":{"function_hash":"62880327635086726946511715158073627773","length":1829},"id":"CVE-2024-41565-d4eac68d","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:L/S:U/UI:N"}]}