CVE-2023-54396: PocketMine-MP before 4.8.1 Server Crash via Banner NBT

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-10-08
Weakness: CWE-129

Description

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

Affected products

pmmp PocketMine-MP: before 4.8.1 — fixed in 4.8.1

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 4.8.1. Check the vendor advisory for mitigations.

References

https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt

Get alerted when CVE-2023-54396 or the next vulnerability affects your stack