CVE-2023-54390

HIGH NVD

CVSS Score 7.5

Severity HIGH

Published Sep 09, 2026

Vendor unknown

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

References

https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket