# CVE-2023-54392: PocketMine-MP NBT tag validation bypass in BlockActorDataPacket

Source: https://junglewise.ai/threats/cve-2023-54392-pocketmine-mp-nbt-tag-validation-bypass-in-blockactordatapacket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-54392 · Severity: medium · CVSS 6.5 · Published 2026-09-09

PocketMine-MP is a popular Minecraft Bedrock Edition server software. Versions 4.20.0 through 4.22.2 and 5.0.0 through 5.2.0 fail to properly validate NBT (Named Binary Tag) data types in network packets, allowing any connected player to crash the server by sending a malformed sign data packet with incorrect tag types.

Technologies: [pocketmine/pocketmine-mp (Packagist)](https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-54392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-54392 being exploited in the wild.

**How severe is CVE-2023-54392?** Medium severity, with a CVSS score of 6.5, published 9 September 2026.

**Which products and versions are affected?** pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=4.20.0,fixed=4.22.3.

**Is there a fix for CVE-2023-54392?** Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.22.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-54392 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2023-54392?** Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pocketmine/pocketmine-mp (Packagist): upgrade to 4.22.3 or later

  ```sh
  composer require pocketmine/pocketmine-mp:^4.22.3
  ```


## Technical details

The vulnerability is an insufficient input validation flaw in the BlockActorDataPacket handler. When processing sign NBT data, the code fails to validate that tag types match expected types (e.g., expecting CompoundTag but receiving ByteTag), resulting in an unhandled UnexpectedTagTypeException in the InGamePacketHandler. Attack vector is network-based with low complexity; a low-privileged player (any connected player) can exploit this without user interaction by crafting a malformed BlockActorDataPacket. Exploitation causes the server process to terminate, resulting in denial of service. The vulnerability was patched in versions 4.22.3 and 5.2.1 via commit 0c250a2, which added proper exception handling and type validation.

## Affected products

- PocketMine PocketMine-MP 4.20.0 to 4.22.2, 5.0.0 to 5.2.0

## Identifiers

- CVE-2023-54392
- GHSA-7wrv-6h42-w54f

## Timeline

- 2023-07-14: disclosed: GitHub security advisory GHSA-7wrv-6h42-w54f published
- 2023: patched: Fixed in versions 4.22.3 and 5.2.1 via commit 0c250a2

## References

- [https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea](https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea)
- [https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f](https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f)

## Related threats

- [PocketMine-MP denial of service in ModalFormResponsePacket handling](https://junglewise.ai/threats/cve-2026-86204-pocketmine-mp-denial-of-service-in-modalformresponsepacket)
- [PocketMine-MP item duplication via despawn entity attack race condition](https://junglewise.ai/threats/cve-2026-86203-pocketmine-mp-item-duplication-via-despawn-entity-attack-race)
- [PocketMine-MP network amplification in ActorEventPacket](https://junglewise.ai/threats/cve-2026-86202-pocketmine-mp-network-amplification-in-actoreventpacket)
- [PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing)
- [PocketMine-MP denial of service in LoginPacket handler](https://junglewise.ai/threats/cve-2026-86200-pocketmine-mp-denial-of-service-in-loginpacket-handler)