What’s Vulnerable › Vulnerabilities

CVE-2023-54395: PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-08
• Weakness: CWE-407

Description

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.

Affected products

• pmmp PocketMine-MP: before 4.12.5 — fixed in 4.12.5

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.12.5. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/3baa5ab71214f96e6e7ab12cb9beef08118473b5
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7m9r-rq9j-wmmh
• https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.5-denial-of-service-via-modalformresponsepacket

Get alerted when CVE-2023-54395 or the next vulnerability affects your stack