CVE-2023-54390
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 9, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 1, 2026
Description
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-1025 Comparison Using Wrong Factors
Affected Products
| Product | Versions |
|---|---|
PocketMine-MPpmmp |
|
References
- GitHub Security Advisory (GHSA-92jh-gwch-jq38)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: PocketMine-MP before 5.3.1 Denial of Service via LoginPacketthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.