CVE-2023-54355: PocketMine-MP Server Crash DoS Vulnerability

CVE-2023-54355 Overview

CVE-2023-54355 affects PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey field in the LoginPacket uses the required secp384r1 elliptic curve. Attackers can submit login packets containing keys built with different elliptic curves or non-EC key types. These malformed keys pass initial login verification but trigger an uncaught exception during Elliptic Curve Diffie-Hellman (ECDH) key derivation. The result is a full server crash, causing denial of service against any exposed PocketMine-MP instance. The weakness is classified under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Any unauthenticated network attacker can crash a vulnerable PocketMine-MP server by sending a single crafted LoginPacket.

Affected Products

PocketMine-MP versions prior to 5.3.1
PocketMine-MP versions prior to 4.23.1
Minecraft: Bedrock Edition servers running affected PocketMine-MP builds

Discovery Timeline

2026-09-09 - CVE-2023-54355 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2023-54355

Vulnerability Analysis

PocketMine-MP uses JSON Web Tokens (JWTs) during the Bedrock login handshake. The identityPublicKey field inside the LoginPacket is expected to be an elliptic curve public key on the secp384r1 curve, matching Mojang's Bedrock signing chain. The affected versions parse this key with OpenSSL but do not confirm that the resulting key is an EC key on the expected curve. Validation of the JWT signature succeeds when the key is a syntactically valid public key of any supported type. Later in the handshake, the server attempts an ECDH key agreement using this attacker-controlled key. When the key belongs to a different curve or is not an EC key at all, the underlying OpenSSL call throws an exception that is not caught by the login task. The exception propagates out of the async worker and terminates the server process.

Root Cause

The root cause is missing curve enforcement in src/network/mcpe/JwtUtils.php and src/network/mcpe/auth/ProcessLoginTask.php. The code accepted any public key that OpenSSL could parse, treating signature verification success as proof of key suitability. This violates the principle that cryptographic material must be validated against protocol-mandated parameters before use.

Attack Vector

Exploitation requires only network reachability to the server's game port. An attacker crafts a LoginPacket where the JWT chain terminates in a public key on a non-secp384r1 curve (for example prime256v1) or an RSA key. The server accepts the login for signature purposes, then attempts ECDH derivation against the attacker key, raising an uncaught exception and crashing.

php

// Patch excerpt from src/network/mcpe/JwtUtils.php
 use const STR_PAD_LEFT;

 final class JwtUtils{
+	public const BEDROCK_SIGNING_KEY_CURVE_NAME = "secp384r1";

 	/**
 	 * @return string[]
// Source: https://github.com/pmmp/PocketMine-MP/commit/4e646d19a4a1e0d082bd4d1f5a58ae0182a268d9

The patch introduces an explicit BEDROCK_SIGNING_KEY_CURVE_NAME constant used to reject keys that do not match secp384r1 before the key reaches ECDH derivation.

Detection Methods for CVE-2023-54355

Indicators of Compromise

Unexpected PocketMine-MP process termination immediately following an inbound connection to the Bedrock game port.
Server logs containing OpenSSL errors referencing curve mismatch, EC key type errors, or unhandled exceptions inside ProcessLoginTask.
Repeated short-lived connections from a single source address preceding server crashes.

Detection Strategies

Monitor PocketMine-MP crash logs for uncaught exceptions originating from ProcessLoginTask or JwtUtils during login processing.
Alert on process restart loops managed by systemd, Docker, or process supervisors wrapping the PocketMine-MP server.
Correlate inbound UDP traffic to the Bedrock listening port with abrupt drops in server availability.

Monitoring Recommendations

Enable verbose logging for the network subsystem to capture malformed LoginPacket payloads.
Track connection counts and unique source addresses hitting the game port to detect targeted probing.
Forward server logs to a centralized log platform and build availability dashboards that flag repeated process exits.

How to Mitigate CVE-2023-54355

Immediate Actions Required

Upgrade PocketMine-MP to version 5.3.1 or 4.23.1 or later without delay.
Restrict inbound access to the Bedrock game port to trusted networks or players where operationally feasible.
Deploy a supervisor to automatically restart the server process while patching is in progress.

Patch Information

The fix is delivered in PocketMine-MP releases 5.3.1 and 4.23.1. The change is tracked in commit 4e646d1 and documented in the PocketMine-MP GHSA-79rc-jjh6-rc89 advisory. Additional context is available in the VulnCheck advisory for PocketMine-MP 5.2.0. The patch adds curve enforcement so that only keys on secp384r1 are accepted for the Bedrock login chain.

Workarounds

Place the server behind a proxy or firewall that permits connections only from known player IP ranges until the upgrade is applied.
Use whitelist mode combined with network-layer access controls to limit exposure to unauthenticated attackers.
Run the server under a supervisor such as systemd with automatic restart to reduce downtime from crash attempts.

bash

# Upgrade PocketMine-MP using the official installer
./start.sh --version=5.3.1

# Or pin the patched branch when building from source
git fetch --tags
git checkout 5.3.1
composer install --no-dev