CVE-2023-54395: PocketMine-MP DoS Vulnerability

CVE-2023-54395 Overview

CVE-2023-54395 is a denial-of-service vulnerability in PocketMine-MP versions before 4.12.5. The flaw resides in ModalFormResponsePacket processing, where the server accepts and parses arbitrarily large JSON payloads submitted by connected clients. Attackers can send numerous oversized modal form response packets to exhaust CPU resources on the server. Once resources are consumed, the server can no longer process legitimate player connections. The weakness is classified under CWE-407: Inefficient Algorithmic Complexity.

Critical Impact
An authenticated attacker on the network can render a PocketMine-MP server unresponsive by flooding it with large ModalFormResponsePacket JSON payloads, denying service to legitimate players.

Affected Products

PocketMine-MP server software versions prior to 4.12.5
Minecraft: Bedrock Edition server deployments running vulnerable PocketMine-MP builds
Any hosted PocketMine-MP instances accepting untrusted client connections

Discovery Timeline

2026-09-09 - CVE-2023-54395 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54395

Vulnerability Analysis

PocketMine-MP is a server implementation for Minecraft: Bedrock Edition written in PHP. During normal gameplay, servers send modal forms to clients and receive responses via the ModalFormResponsePacket. The response body is JSON-encoded and parsed server-side inside the in-game packet handler.

Before version 4.12.5, the handler did not enforce a reasonable upper bound on the size of the JSON payload it would decode. Attackers can submit oversized payloads that are computationally expensive to parse. Repeating the request in a loop drives CPU consumption toward saturation, blocking the main server loop from servicing other clients.

Root Cause

The root cause is inefficient algorithmic handling of untrusted input in the modal form response path. The server treated form response JSON as trusted-sized data and passed it through parsing routines without bounding the input. This meets the definition of CWE-407, where worst-case processing time is disproportionate to input size and can be forced by an attacker.

Attack Vector

Exploitation requires network access and low-privilege authentication as a connected client. No user interaction on the server side is required. An attacker connects to the server, then transmits a stream of ModalFormResponsePacket messages containing very large JSON bodies. The server thread consumes CPU parsing each payload, and the tick loop stalls, preventing new logins and dropping active sessions.

The upstream fix ships in PocketMine-MP commit 3baa5ab7 to src/network/mcpe/handler/InGamePacketHandler.php. The relevant diff removes an obsolete workaround as part of the hardening in that handler:

php

 use function base64_encode;
 use function count;
 use function fmod;
-use function implode;
 use function in_array;
 use function is_bool;
 use function is_infinite;

Source: GitHub commit 3baa5ab7. Refer to the GHSA-7m9r-rq9j-wmmh advisory for the complete set of handler changes that constrain modal form response sizes.

Detection Methods for CVE-2023-54395

Indicators of Compromise

Sustained 100% CPU usage on the PocketMine-MP process without a corresponding increase in active players.
Sharp increase in inbound ModalFormResponsePacket frames from a single client or small set of clients.
Server log entries showing tick durations exceeding expected thresholds and dropped keepalive responses.
Legitimate players unable to complete the login handshake against an otherwise reachable server.

Detection Strategies

Instrument packet handlers to record the byte size of incoming ModalFormResponsePacket payloads and alert on outliers.
Sample tick duration metrics from the server and correlate spikes with per-client packet rates.
Track connection-level statistics such as packets-per-second and bytes-per-second, and flag clients that exceed baseline by an order of magnitude.

Monitoring Recommendations

Export PocketMine-MP process metrics (CPU, memory, tick latency) to a time-series backend for continuous baselining.
Forward server logs and network flow data to a centralized analytics platform for correlation and long-term retention.
Alert on repeated disconnect events tied to server timeout rather than client action.

How to Mitigate CVE-2023-54395

Immediate Actions Required

Upgrade PocketMine-MP to version 4.12.5 or later on every server node.
Audit installed plugins that interact with modal forms and confirm they are compatible with the patched release.
Restart the server after upgrade and validate that packet handlers report the expected version.

Patch Information

The fix is delivered in PocketMine-MP 4.12.5. The upstream change is available in commit 3baa5ab7 and documented in GHSA-7m9r-rq9j-wmmh. Additional context is available in the VulnCheck advisory.

Workarounds

Place the server behind a proxy or firewall that enforces per-connection bandwidth and packet-rate limits.
Restrict server access to allow-listed IP ranges until the patched version is deployed.
Enable whitelisting so that only authenticated, known players can connect and submit packets.
Monitor and rapidly kick or ban clients that exceed a defined packet-size or packet-rate threshold.

bash

# Verify the installed PocketMine-MP version before and after upgrade
php PocketMine-MP.phar --version

# Example iptables rule to rate-limit inbound Bedrock UDP traffic per source
iptables -A INPUT -p udp --dport 19132 -m hashlimit \
  --hashlimit-name pmmp_dos --hashlimit-mode srcip \
  --hashlimit-above 200/second --hashlimit-burst 400 -j DROP