CVE-2023-54394: PocketMine-MP DOS Vulnerability

CVE-2023-54394 Overview

CVE-2023-54394 affects PocketMine-MP versions before 4.18.0-ALPHA2, a PHP-based server software for Minecraft: Bedrock Edition. The server fails to rate-limit mismatch type InventoryTransactionPacket requests from connected clients. Attackers can send numerous mismatch transactions to force the server into transmitting large amounts of serialized inventory data. This results in bandwidth amplification, consuming significant server resources without requiring full authentication. The flaw is categorized under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Remote attackers with low privileges can amplify outbound bandwidth consumption on affected PocketMine-MP servers, degrading availability for legitimate players.

Affected Products

PocketMine-MP server software versions prior to 4.18.0-ALPHA2
Minecraft: Bedrock Edition server deployments running vulnerable PocketMine-MP builds
Any hosted or self-managed environment exposing PocketMine-MP over the network

Discovery Timeline

2026-09-09 - CVE-2023-54394 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54394

Vulnerability Analysis

The vulnerability resides in the network handling of InventoryTransactionPacket messages within PocketMine-MP. When a client sends a mismatch type transaction, the server responds by resynchronizing inventory state and transmitting serialized inventory data back to the client. The server does not limit how often a client may trigger this synchronization path. An attacker who joins the server can repeatedly send crafted mismatch transactions, forcing the server to generate and emit large payloads for each request. This asymmetric response produces a bandwidth amplification condition consistent with CWE-770. See the VulnCheck Advisory on PocketMine-MP for additional context.

Root Cause

The root cause is missing throttling on the mismatch transaction handling path in src/network/mcpe/InventoryManager.php. Every mismatch produces an immediate, synchronous resync response rather than a deduplicated or rate-limited one. Inventory content and slot updates are emitted per event, without batching or coalescing.

Attack Vector

Exploitation requires network access to a PocketMine-MP server and a low-privileged connected session. The attacker sends a high volume of mismatch type InventoryTransactionPacket requests. Each request forces the server to serialize and transmit inventory data, exhausting outbound bandwidth and degrading service for other players.

php

// Patch excerpt from src/network/mcpe/InventoryManagerEntry.php
// Buffers slot and content syncing until the end of the tick

    */
    public array $itemStackInfos = [];

+   /**
+    * @var int[]
+    * @phpstan-var array<int, int>
+    */
+   public array $pendingSyncs = [];
+
    public function __construct(
        public Inventory $inventory,
        public ?ComplexInventoryMapEntry $complexSlotMap = null

Source: GitHub Commit ca6d514

Detection Methods for CVE-2023-54394

Indicators of Compromise

Sustained high volume of InventoryTransactionPacket messages from a single client session
Unusual outbound bandwidth spikes correlated with individual player connections
Repeated inventory resynchronization events logged by the PocketMine-MP server
Server tick latency increases or dropped connections for unrelated clients during traffic spikes

Detection Strategies

Instrument the PocketMine-MP server to log per-session counts of mismatch transaction events and alert on abnormal rates.
Deploy network flow monitoring in front of exposed Minecraft servers to detect asymmetric ingress-to-egress ratios per client.
Correlate application logs with network telemetry to attribute bandwidth anomalies to specific player sessions.

Monitoring Recommendations

Baseline normal InventoryTransactionPacket volume per session and alert on deviations.
Track outbound bandwidth per connected client and flag sessions that generate disproportionate egress.
Retain server logs and network metadata to support post-incident analysis of amplification attempts.

How to Mitigate CVE-2023-54394

Immediate Actions Required

Upgrade PocketMine-MP to 4.18.0-ALPHA2 or later, which introduces buffered slot and content syncing at end-of-tick.
Restrict server exposure to trusted networks or place the server behind rate-limiting proxies where feasible.
Review server logs for prior high-volume mismatch transaction activity indicative of abuse.

Patch Information

The fix is committed in GitHub Commit ca6d514 and documented in GitHub Security Advisory GHSA-42qm-8v8m-m78c. The patch adds a pendingSyncs buffer to InventoryManagerEntry so that redundant slot and content synchronization events are coalesced until the end of the server tick, eliminating the amplification factor.

Workarounds

Apply upstream network-level rate limiting on the Minecraft server port to cap per-source packet rates.
Restrict server access via allowlists or whitelist-only mode until the upgrade is deployed.
Monitor and administratively disconnect sessions that produce anomalous mismatch transaction volume.

bash

# Configuration example: upgrade PocketMine-MP to a patched release
git fetch --tags
git checkout 4.18.0-ALPHA2
composer install --no-dev
# Restart the server after upgrade
./start.sh