What’s Vulnerable › Vulnerabilities

CVE-2023-54355: PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-08
• Weakness: CWE-347

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.

Affected products

• pmmp PocketMine-MP: before 4.23.1; from 5.2.0 before 5.3.1 — fixed in 4.23.1, 5.3.1

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.23.1, 5.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/4e646d19a4a1e0d082bd4d1f5a58ae0182a268d9
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-79rc-jjh6-rc89
• https://www.vulncheck.com/advisories/pocketmine-mp-5.2.0-server-crash-via-incorrect-ec-curve

Get alerted when CVE-2023-54355 or the next vulnerability affects your stack