CVE-2023-54392: PocketMine-MP Server Crash DoS Vulnerability

CVE-2023-54392 Overview

CVE-2023-54392 is a denial-of-service vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. The flaw exists in versions >= 4.20.0 before 4.22.3 and in the 5.x branch before 5.2.1. The server fails to validate Named Binary Tag (NBT) types inside BlockActorDataPacket messages. An authenticated player can send a crafted sign NBT payload with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process. The weakness is classified under [CWE-20] Improper Input Validation.

Critical Impact
Any authenticated player can crash the PocketMine-MP server process remotely by sending a single malformed packet, causing full service disruption for all connected users.

Affected Products

PocketMine-MP >= 4.20.0 and < 4.22.3
PocketMine-MP 5.x branch < 5.2.1
Minecraft: Bedrock Edition servers running affected PocketMine-MP builds

Discovery Timeline

2026-09-09 - CVE-2023-54392 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54392

Vulnerability Analysis

PocketMine-MP processes BlockActorDataPacket messages inside InGamePacketHandler to update tile-entity state such as signs. The handler reads NBT tag data supplied by the client but does not verify that each tag matches the expected type. When a player submits sign NBT with a tag whose type differs from what the parser expects, the NBT library raises an UnexpectedTagTypeException. That exception is not caught in the packet handling path, so it propagates to the main server loop and stops the process. The result is a network-reachable denial of service that requires only low-privileged authenticated access.

Root Cause

The root cause is improper input validation of untrusted NBT structures received from clients. The packet handler assumed that NBT tag types would match schema expectations and did not defensively check tag classes before casting or reading their values. Any deviation surfaced as an uncaught exception rather than a controlled protocol error.

Attack Vector

Exploitation requires network access to the server and a valid player session. The attacker crafts a BlockActorDataPacket referencing a sign block and populates the NBT payload with a tag of the wrong type where the server expects a string or compound value. On receipt, the handler dispatches the tag to code that raises UnexpectedTagTypeException, which unwinds through the packet loop and terminates the server.

php

// Patch excerpt: src/network/mcpe/handler/InGamePacketHandler.php
 use pocketmine\utils\Utils;
 use pocketmine\world\format\Chunk;
 use function array_push;
-use function base64_encode;
 use function count;
 use function fmod;
+use function get_debug_type;
 use function implode;
 use function in_array;
 use function is_bool;

Source: PocketMine-MP commit 0c250a2. The patch introduces get_debug_type() for consistent handling of invalid NBT data in BlockActorDataPacket, replacing the previous logic that surfaced raw exceptions.

Detection Methods for CVE-2023-54392

Indicators of Compromise

Unexpected PocketMine-MP process termination shortly after a player joins or interacts with a sign block.
Server logs containing UnexpectedTagTypeException stack traces referencing InGamePacketHandler or NBT parsing routines.
Repeated crash-restart cycles correlated with a single player session or source IP address.

Detection Strategies

Parse PocketMine-MP crash dumps and log files for the UnexpectedTagTypeException signature tied to BlockActorDataPacket handling.
Correlate server exit events with the last authenticated player and packet sequence to identify likely abusers.
Deploy protocol-aware monitoring on the Minecraft Bedrock port (default UDP 19132) to flag anomalous BlockActorDataPacket volumes.

Monitoring Recommendations

Forward PocketMine-MP application logs and crash reports to a centralized SIEM for retention and alerting on the exception signature.
Alert on server process restarts that exceed a baseline threshold within a short interval.
Track player join events, packet counts per session, and the source IP addresses associated with server termination events.

How to Mitigate CVE-2023-54392

Immediate Actions Required

Upgrade PocketMine-MP to 4.22.3 or later on the 4.x branch, or to 5.2.1 or later on the 5.x branch.
Restrict server access to trusted players using an allowlist while the upgrade is scheduled.
Enable automated process supervision so the server restarts after a crash, reducing downtime during exploitation attempts.

Patch Information

The fix is included in PocketMine-MP 4.22.3 and 5.2.1. See the GitHub Security Advisory GHSA-7wrv-6h42-w54f, the upstream commit 0c250a2, and the VulnCheck advisory for full remediation guidance.

Workarounds

Operate the server behind a proxy or firewall that limits BlockActorDataPacket frequency per client.
Disable public access and require authentication through a trusted lobby until the patched release is deployed.
Ban and remove player accounts that trigger repeated UnexpectedTagTypeException crashes.

bash

# Upgrade PocketMine-MP to a patched release
# 4.x branch
composer require pocketmine/pocketmine-mp:^4.22.3

# 5.x branch
composer require pocketmine/pocketmine-mp:^5.2.1

# Verify installed version
php PocketMine-MP.phar --version