Junglewise Threat Intelligence

CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing

CVE-2023-54393 · Severity: high · CVSS 7.5 · Published 2026-09-09

Technologies: PocketMine-MP.

Executive brief

PocketMine-MP is a Minecraft server software used by game server operators. A vulnerability in how the server processes login messages allows attackers to send specially crafted network packets that crash the server, causing a denial of service that disrupts gameplay for all connected players.

Technical details

The vulnerability is a denial of service flaw in the LoginPacket JSON parsing code, stemming from improper validation in the JsonMapper dependency (specifically issue #210 in cweiske/JsonMapper). An unauthenticated attacker on the network can send malformed JSON structures within LoginPacket messages to trigger a crash on the server. The attack requires network access to the Minecraft server port but no prior authentication. The flaw was resolved by switching to a maintained fork of JsonMapper that addresses the validation issue. Patch version 4.20.5 and later contain the fix.

Affected products

  • PocketMine PocketMine-MP before 4.20.5

Timeline

  • 2026-09-09: disclosed: Published on NVD
  • 2026-09-09: patched: Fixed in version 4.20.5

References