HIGH 8.7 NVD
CVE-2023-54390
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arra
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
References
- https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
- https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-logi
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-09 via NVD.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.