CVE-2023-54396

Deferred Deferred - Pending Action

Dye Color Validation Bypass in PocketMine-MP

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-28

NVD

CVE-2023-54396

EUVD

EUVD-2023-60626

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	pocketmine-mp	to 4.8.1 (exc)
pocketmine-mp	pocketmine-mp	to 4.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability affects PocketMine-MP versions before 4.8.1. It involves improper validation of dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or commands, causing undefined offset errors that crash the server.

Detection Guidance

Detecting this vulnerability requires checking the PocketMine-MP server version. Run the command '/version' in-game or check the server log files for the PocketMine-MP version. If the version is below 4.8.1, the server is vulnerable.

Impact Analysis

This vulnerability can lead to server crashes when invalid dye color IDs are processed. Attackers can exploit it via network requests or commands to cause a denial-of-service condition, making the server unavailable.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a server crash issue caused by improper input validation in a game server software. Standards like GDPR and HIPAA focus on data protection, privacy, and security controls, while this vulnerability primarily impacts service availability due to crashes.

Mitigation Strategies

Update PocketMine-MP to version 4.8.1 or later immediately. This can be done by downloading the latest release from the official PocketMine-MP GitHub repository and replacing the existing files.

Hi! I’m here to help you understand CVE-2023-54396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70