CVE-2023-54396

MEDIUM 6.5

PocketMine-MP before 4.8.1 Server Crash via Banner NBT

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

CWE	CWE-129
Vendor	pmmp
Product	pocketmine-mp
Published	Sep 9, 2026
Last Updated	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for pmmp pocketmine-mp

Be the first to know when new medium vulnerabilities affecting pmmp pocketmine-mp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

pmmp / PocketMine-MP

0 < 4.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5g github.com: https://github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765eb vulncheck.com: https://www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbt