CVE-2023-54355

Deferred Deferred - Pending Action

PocketMine-MP LoginPacket ECDH Key Derivation Failure

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-28

NVD

CVE-2023-54355

EUVD

EUVD-2023-60620

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	pocketmine-mp	to 5.3.1\|end_excluding=4.23.1 (exc)
pocketmine-mp	pocketmine-mp	to 5.3.1 (exc)
pocketmine-mp	pocketmine-mp	to 4.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

CVE-2023-54355 is a server crash vulnerability in PocketMine-MP where the server fails to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can send LoginPackets with keys using different curves or non-EC key types. These keys pass login verification but cause an uncaught exception during ECDH key derivation, crashing the server.

Detection Guidance

To detect this vulnerability, monitor PocketMine-MP server logs for crashes during login attempts. Check if the server is running versions before 5.3.1 or 4.23.1. Use network traffic analysis tools like Wireshark to inspect LoginPacket identityPublicKey fields for non-secp384r1 curves or non-EC keys.

Impact Analysis

This vulnerability allows attackers to remotely crash PocketMine-MP servers by sending malformed LoginPackets. The server crashes during key derivation, causing denial of service. Servers running unpatched versions before 5.3.1 or 4.23.1 are vulnerable.

Compliance Impact

This vulnerability primarily impacts server availability by causing crashes, which could lead to denial-of-service conditions. While it does not directly expose user data, prolonged downtime may affect compliance with regulations requiring high availability for services handling personal or health data under GDPR or HIPAA. The lack of proper key validation could also introduce integrity risks if malicious actors exploit the crash to manipulate server behavior.

Mitigation Strategies

Immediately update PocketMine-MP to version 5.3.1 or 4.23.1 or later. If updating is not possible, implement a workaround by validating that all identityPublicKey values use the secp384r1 curve before processing login packets.

Hi! I’m here to help you understand CVE-2023-54355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70