CVE-2023-54394 PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...

CVE-2023-54392 PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

EUVD-2023-60622

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

CVE-2023-54392

PocketMine-MP versions ≥ 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in the BlockActorDataPacket . An authenticated player can send a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that te...

CVE-2023-54392 PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

CVE-2023-54392 PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions = 4.20.0 before 4.22.3 and before 5.2.1 in the 5.x branch fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that...

EUVD-2023-60621

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54355 PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

EUVD-2023-60620

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2023-54390

PocketMine-MP versions before 5.3.1 and 4.23.1 are vulnerable to a denial of service caused by improper null value handling in arrays during LoginPacket JSON parsing. An unauthenticated, remote attacker can send malformed JSON containing unexpected null elements in the LoginPacket to crash the se...

CVE-2023-54355

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. An unauthenticated network attacker can supply a LoginPacket with a key on a different curve or a non-EC key type, passing login verification but t...

CVE-2023-54355 PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2023-54355 PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2023-54390 PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

PT-2026-89002

🚨 HIGH SEVERITY: CVE-2026-86199 CVSS 7.5 PocketMine-MP 5.43.1 vulnerable to unauthenticated server crash via certificate validation bypass. Patch immediately. CVE Vulnerability PatchNow ThreatIntel CyberSecurity https://t.co/RrkmnFX0tI...

CVE-2026-86204: Uncontrolled Resource Consumption

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the...

CVE-2026-86202: Insufficient Control of Network Message Volume (Network Amplification)

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste...

CVE-2025-71417: Improper Input Validation

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...