CVE-2023-54390: PocketMine-MP JSON Parsing DoS Vulnerability

CVE-2023-54390 Overview

CVE-2023-54390 is a denial of service vulnerability in PocketMine-MP, a server software for Minecraft: Bedrock Edition. The flaw exists in the LoginPacket JSON parsing logic and stems from improper handling of null values inside arrays [CWE-1025]. Unauthenticated attackers can send a malformed LoginPacket containing unexpected null elements to crash the server process. The vulnerability affects PocketMine-MP versions before 5.3.1 and 4.23.1. Exploitation requires no privileges, no user interaction, and can be performed remotely over the network.

Critical Impact
A remote, unauthenticated attacker can crash a PocketMine-MP server by sending a single malformed LoginPacket, disrupting availability for all connected players.

Affected Products

PocketMine-MP versions before 5.3.1
PocketMine-MP versions before 4.23.1
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds

Discovery Timeline

2026-09-09 - CVE-2023-54390 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54390

Vulnerability Analysis

The vulnerability resides in the JSON deserialization path used by PocketMine-MP when handling the LoginPacket sent by clients during the connection handshake. The parser assumes array elements are well-formed objects. When it encounters a null value where a structured element is expected, the server raises an unhandled exception and terminates the process.

Because the LoginPacket is processed before authentication completes, an attacker does not need valid credentials. A single malformed packet is sufficient to trigger the crash. This maps to CWE-1025 (Comparison Using Wrong Factors) as classified in the advisory, reflecting improper validation of incoming JSON structure.

The impact is limited to availability. No confidentiality or integrity boundaries are crossed. However, servers hosting multiplayer environments are effectively taken offline until restarted, and repeated attacks produce sustained denial of service.

Root Cause

The root cause is missing input validation in the LoginPacket JSON handler. Array elements are dereferenced without checking whether the value is null. The absence of a defensive type check allows a crafted payload to reach code paths that assume a non-null object, producing an unhandled runtime error.

Attack Vector

Exploitation occurs over the network against the PocketMine-MP listener port. The attacker crafts a LoginPacket containing null elements inside arrays that the parser expects to be populated. Because the packet is processed pre-authentication, the attack requires only network reachability to the server.

Refer to the GitHub Security Advisory GHSA-92jh-gwch-jq38 and the VulnCheck Denial of Service Advisory for additional technical context. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2023-54390

Indicators of Compromise

Unexpected PocketMine-MP process termination shortly after inbound connections from unfamiliar IP addresses.
Server logs showing exceptions raised during LoginPacket deserialization or JSON parsing.
Repeated short-lived connections from the same source immediately preceding a crash.
Elevated inbound traffic to the Bedrock server port (default UDP 19132) without corresponding successful logins.

Detection Strategies

Monitor PocketMine-MP stdout, stderr, and crash dump files for parser exceptions referencing LoginPacket or JSON handling.
Alert on process restarts of the PocketMine-MP service outside of scheduled maintenance windows.
Correlate network flow data with server crash events to identify the source IP of malformed packets.

Monitoring Recommendations

Enable verbose logging for the network handler to capture packet metadata prior to a crash.
Track uptime metrics and page operators when the PocketMine-MP process restarts unexpectedly.
Rate-limit inbound connections at the network edge and log connection attempts that never complete the login handshake.

How to Mitigate CVE-2023-54390

Immediate Actions Required

Upgrade PocketMine-MP to version 5.3.1 or later on the 5.x branch.
Upgrade PocketMine-MP to version 4.23.1 or later on the 4.x branch.
Restrict inbound access to the server port to trusted networks where feasible.
Verify that server auto-restart tooling is in place to reduce downtime while patches are rolled out.

Patch Information

The fix is applied in the upstream commit referenced in the GitHub Commit Reference. The patched builds are PocketMine-MP 5.3.1 and 4.23.1. Administrators should download the fixed release from the official PocketMine-MP distribution channels and validate the upgrade in a staging environment before production rollout.

Workarounds

Place the server behind a firewall or reverse proxy that allows only known player IP ranges.
Use a process supervisor such as systemd or pm2 to automatically restart the server after a crash.
Deploy connection rate-limiting at the network perimeter to slow repeated exploit attempts against the login handler.

bash

# Configuration example: verify installed PocketMine-MP version
./start.sh --version

# Example systemd auto-restart directive for the PocketMine-MP service
# /etc/systemd/system/pocketmine.service
# [Service]
# Restart=always
# RestartSec=5