CVE-2023-54390

Deferred Deferred - Pending Action

LoginPacket JSON Parsing DoS in PocketMine-MP

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-28

NVD

CVE-2023-54390

EUVD

EUVD-2023-60621

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	mp	to 5.3.1\|end_excluding=4.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1025	The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

Executive Summary

CVE-2023-54390 is a denial of service vulnerability in PocketMine-MP versions before 5.3.1 and 4.23.1. It occurs due to improper handling of null values in JSON arrays within the LoginPacket. Attackers can send malformed JSON with unexpected null elements to crash the server.

Detection Guidance

Monitor PocketMine-MP server logs for crashes during player login attempts. Check for malformed JSON errors in logs when LoginPacket is processed. Use network traffic analysis tools like Wireshark to inspect incoming JSON data for unexpected null values in arrays.

Impact Analysis

This vulnerability allows attackers to disrupt server availability without authentication or user interaction. It can cause server crashes, leading to downtime and loss of service for users relying on the PocketMine-MP server.

Compliance Impact

This vulnerability primarily causes server crashes due to improper JSON parsing, leading to denial of service. While it does not directly expose or leak data, prolonged downtime could impact compliance with regulations like GDPR or HIPAA by disrupting access to critical systems or services.

Mitigation Strategies

Upgrade PocketMine-MP to version 5.3.1 or 4.23.1 or later. If upgrading is not immediately possible, implement network-level filtering to block malformed JSON packets containing null values in arrays.

Hi! I’m here to help you understand CVE-2023-54390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70