CVE-2023-54395

Deferred Deferred - Pending Action

Denial-of-Service in PocketMine-MP via Malicious ModalFormResponsePacket

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-28

NVD

CVE-2023-54395

EUVD

EUVD-2023-60625

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	pocketmine-mp	to 4.12.5 (exc)
pocketmine	mp	to 4.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in PocketMine-MP versions before 4.12.5. Attackers can send large JSON payloads in modal form response packets to consume excessive CPU time, preventing the server from processing legitimate connections.

Detection Guidance

Monitor network traffic for unusually large JSON payloads sent to PocketMine-MP servers. Check server logs for repeated ModalFormResponsePacket processing attempts. Use packet inspection tools like Wireshark to filter for large JSON responses targeting PocketMine-MP ports.

Impact Analysis

It can cause server resource exhaustion, leading to degraded performance or complete unavailability for legitimate users. Servers may become unresponsive or crash under sustained attack.

Compliance Impact

This vulnerability primarily impacts server availability by causing resource exhaustion through excessive CPU usage. While it does not directly expose or leak data, prolonged unavailability could potentially violate compliance requirements for availability in standards like GDPR (Article 32) or HIPAA (Security Rule). However, the vulnerability itself does not directly lead to data breaches or unauthorized access.

Mitigation Strategies

Upgrade PocketMine-MP to version 4.12.5 or later immediately. If upgrading is not possible, implement a temporary workaround by intercepting ModalFormResponsePacket, manually decoding JSON, and calling Player->onFormSubmit() directly.

Hi! I’m here to help you understand CVE-2023-54395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70