Quick answers
- Is CVE-2023-54393 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-54393 being exploited in the wild.
- How severe is CVE-2023-54393?
- High severity, with a CVSS score of 7.5, published 9 September 2026.
- Which products and versions are affected?
- pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.20.5.
- Is there a fix for CVE-2023-54393?
- Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.20.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-54393 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2023-54393?
- Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pocketmine/pocketmine-mp (Packagist): upgrade to 4.20.5 or later
composer require pocketmine/pocketmine-mp:^4.20.5
Technical details
The vulnerability is a denial of service flaw in the LoginPacket JSON parsing code, stemming from improper validation in the JsonMapper dependency (specifically issue #210 in cweiske/JsonMapper). An unauthenticated attacker on the network can send malformed JSON structures within LoginPacket messages to trigger a crash on the server. The attack requires network access to the Minecraft server port but no prior authentication. The flaw was resolved by switching to a maintained fork of JsonMapper that addresses the validation issue. Patch version 4.20.5 and later contain the fix.
Affected products
- PocketMine PocketMine-MP before 4.20.5
Identifiers
- CVE-2023-54393
- GHSA-pqp3-8rrw-g8vm
Timeline
- 2026-09-09: disclosed: Published on NVD
- 2026-09-09: patched: Fixed in version 4.20.5