Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2023-54390

PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 4.23.1affected
  • 5.0.0 to < 5.3.1affected
pkg:composer/pocketmine/pocketmine-mp

References