CVE-2023-54390: PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-10-08
Weakness: CWE-1025

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

Affected products

pmmp PocketMine-MP: before 4.23.1; from 5.0.0 before 5.3.1 — fixed in 4.23.1, 5.3.1

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.23.1, 5.3.1. Check the vendor advisory for mitigations.

References

https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket

Get alerted when CVE-2023-54390 or the next vulnerability affects your stack