CVE-2023-54355
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 09, 2026
Vendor
unknown
Description
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.