CVE-2023-54395 in PocketMine-MP
Summary
by MITRE • 09/09/2026
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The identified security flaw resides within PocketMine-MP, a widely used Minecraft: Bedrock Edition multiplayer server software written in PHP. Specifically, versions prior to 4.12.5 are susceptible to a denial-of-service vulnerability located in the handling of ModalFormResponsePacket data structures. This packet type is integral to the game's user interface system, allowing players to interact with modal forms such as menus and dialogs through response submissions. The core technical deficiency lies in the insufficient validation and size constraints applied when processing these JSON payloads upon receipt by the server. Instead of enforcing strict limits on payload dimensions or implementing efficient parsing mechanisms that abort early on oversized data, the software attempts to fully deserialize and process arbitrarily large JSON objects sent by clients.
This architectural oversight creates a direct pathway for resource exhaustion attacks. An adversary can exploit this weakness by crafting and transmitting numerous ModalFormResponsePacket instances containing excessively large JSON payloads. The server is compelled to allocate significant memory and CPU cycles to parse, validate, and manage these malformed or oversized inputs. As the volume of such malicious packets increases, the server's processing capacity becomes saturated. This leads to a state where legitimate network traffic cannot be processed in a timely manner, resulting in severe latency for genuine players or complete unresponsiveness of the game server. The attack effectively transforms a standard gameplay interaction mechanism into a vector for service disruption, undermining the availability aspect of the CIA triad.
From an industry standards perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, and more specifically CWE-203, Observable Discrepancy, as the server's behavior changes noticeably under load due to inefficient handling of input size. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an attacker disrupts services by consuming resources such that legitimate users cannot access them. The attack vector is classified as Network-based with Low Complexity, requiring only network connectivity and the ability to send crafted packets without prior authentication in many default server configurations.
Mitigation strategies must focus on implementing robust input validation and resource management protocols within the packet processing pipeline. Developers should enforce strict maximum size limits for JSON payloads associated with ModalFormResponsePacket structures before any significant parsing or memory allocation occurs. Implementing rate limiting at the network layer can also help mitigate the impact by throttling excessive connections from single sources. For administrators running affected versions, upgrading to version 4.12.5 or later is the primary remediation step as it addresses these internal processing flaws. Until an upgrade is feasible, deploying a reverse proxy with request size limits and connection rate limiting can provide a temporary layer of defense against such resource exhaustion attempts.