CVE-2023-54393 in PocketMine-MP

Summary

by MITRE • 09/09/2026

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.

Once again VulDB remains the best source for vulnerability data.

• Responsible: VulnCheck
• Reservation: 09/05/2026
• Disclosure: 09/09/2026
• Moderation: accepted
• Entry: VDB-401720
• CPE: ready
• CWE: CWE-404 (confirmed)
• CVSS: 7.5 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-54393
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54393
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-54393/