CVE-2023-54396
PocketMine-MP before 4.8.1 Server Crash via Banner NBT
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 9, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 5, 2026
Description
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-129 Improper Validation of Array Index
Affected Products
| Product | Versions |
|---|---|
PocketMine-MPpmmp |
|
References
- GitHub Security Advisory (GHSA-wqqv-jcfr-9f5g)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: PocketMine-MP before 4.8.1 Server Crash via Banner NBTthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.