# CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing

Source: https://junglewise.ai/threats/cve-2023-54393-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-54393 · Severity: high · CVSS 7.5 · Published 2026-09-09

PocketMine-MP is a Minecraft server software used by game server operators. A vulnerability in how the server processes login messages allows attackers to send specially crafted network packets that crash the server, causing a denial of service that disrupts gameplay for all connected players.

Technologies: [pocketmine/pocketmine-mp (Packagist)](https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-54393 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-54393 being exploited in the wild.

**How severe is CVE-2023-54393?** High severity, with a CVSS score of 7.5, published 9 September 2026.

**Which products and versions are affected?** pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.20.5.

**Is there a fix for CVE-2023-54393?** Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.20.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-54393 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2023-54393?** Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pocketmine/pocketmine-mp (Packagist): upgrade to 4.20.5 or later

  ```sh
  composer require pocketmine/pocketmine-mp:^4.20.5
  ```


## Technical details

The vulnerability is a denial of service flaw in the LoginPacket JSON parsing code, stemming from improper validation in the JsonMapper dependency (specifically issue #210 in cweiske/JsonMapper). An unauthenticated attacker on the network can send malformed JSON structures within LoginPacket messages to trigger a crash on the server. The attack requires network access to the Minecraft server port but no prior authentication. The flaw was resolved by switching to a maintained fork of JsonMapper that addresses the validation issue. Patch version 4.20.5 and later contain the fix.

## Affected products

- PocketMine PocketMine-MP before 4.20.5

## Identifiers

- CVE-2023-54393
- GHSA-pqp3-8rrw-g8vm

## Timeline

- 2026-09-09: disclosed: Published on NVD
- 2026-09-09: patched: Fixed in version 4.20.5

## References

- [https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2](https://github.com/pmmp/PocketMine-MP/commit/09668a37d66c6023685a948b7550c918620e98f2)
- [https://github.com/pmmp/PocketMine-MP/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012](https://github.com/pmmp/PocketMine-MP/commit/a31902a31f5b6fdb832f57c0e3a3f16a3b41c012)

## Related threats

- [PocketMine-MP denial of service in ModalFormResponsePacket handling](https://junglewise.ai/threats/cve-2026-86204-pocketmine-mp-denial-of-service-in-modalformresponsepacket)
- [PocketMine-MP item duplication via despawn entity attack race condition](https://junglewise.ai/threats/cve-2026-86203-pocketmine-mp-item-duplication-via-despawn-entity-attack-race)
- [PocketMine-MP network amplification in ActorEventPacket](https://junglewise.ai/threats/cve-2026-86202-pocketmine-mp-network-amplification-in-actoreventpacket)
- [PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing)
- [PocketMine-MP denial of service in LoginPacket handler](https://junglewise.ai/threats/cve-2026-86200-pocketmine-mp-denial-of-service-in-loginpacket-handler)