CVE-2023-54390

HIGH 7.5

PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

CWE	CWE-1025
Vendor	pmmp
Product	pocketmine-mp
Published	Sep 9, 2026
Last Updated	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for pmmp pocketmine-mp

Be the first to know when new high vulnerabilities affecting pmmp pocketmine-mp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

pmmp / PocketMine-MP

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38 github.com: https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c vulncheck.com: https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket

Credits

🔍 alvin0319 dktapps