Is CVE-2023-54394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-54394 being exploited in the wild.

How severe is CVE-2023-54394?

Medium severity, with a CVSS score of 4.3, published 9 September 2026.

Which products and versions are affected?

pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.18.0-ALPHA2.

Is there a fix for CVE-2023-54394?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.0-ALPHA2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-54394 attacked?

It is attacked over the network.

Am I affected by CVE-2023-54394?

Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-54394: PocketMine-MP missing rate-limit for mismatch inventory transactions

CVE-2023-54394 · Severity: medium · CVSS 4.3 · Published 2026-09-09

PocketMine-MP is a Minecraft server implementation that manages player inventories and item synchronization. An attacker can send mismatch inventory transaction requests without rate-limiting, forcing the server to send large amounts of serialized inventory data repeatedly, consuming significant bandwidth and potentially degrading server performance for legitimate players.

Technologies: pocketmine/pocketmine-mp (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2023-54394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-54394 being exploited in the wild.
How severe is CVE-2023-54394?: Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?: pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=4.18.0-ALPHA2.
Is there a fix for CVE-2023-54394?: Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.0-ALPHA2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-54394 attacked?: It is attacked over the network.
Am I affected by CVE-2023-54394?: Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pocketmine/pocketmine-mp (Packagist): upgrade to 4.18.0-ALPHA2 or later
```
composer require pocketmine/pocketmine-mp:^4.18.0-ALPHA2
```

Technical details

PocketMine-MP fails to rate-limit "mismatch" type InventoryTransactionPacket requests, which are used by clients to request a resync of all open inventories. An attacker with network access and low privileges (ability to connect as a player) can send numerous mismatch transactions per tick, causing the server to synchronize and transmit large amounts of serialized inventory data repeatedly. Since network-serialized inventory items can be very large (especially with NBT data), this acts as a bandwidth amplification attack. The vulnerability was patched in version 4.18.0-ALPHA2 by deferring inventory synchronization until the end of the tick and implementing the ItemStackRequest system.

Affected products

PocketMine PocketMine-MP before 4.18.0-ALPHA2

Identifiers

CVE-2023-54394
GHSA-42qm-8v8m-m78c

Timeline

2023-05-30: disclosed
2023-03-20: patched: Fix commit ca6d514 merged; patch released in version 4.18.0-ALPHA2
2023-05-30: advisory: GHSA-42qm-8v8m-m78c published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.