CVE-2023-54390: Pmmp Pocketmine-Mp

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

Affected products

• Pmmp Pocketmine-Mp: before 4.23.1 (fixed in 4.23.1); from 5.0.0, before 5.3.1 (fixed in 5.3.1)

Published 2026-09-09. Last modified 2026-10-08.