CVE-2023-54396: PocketMine-MP DoS Vulnerability

CVE-2023-54396 Overview

CVE-2023-54396 affects PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition, in versions before 4.8.1. The server fails to validate dye color IDs in banner Named Binary Tag (NBT) data during deserialization. Authenticated players can supply invalid color values through inventory transactions or commands to trigger an undefined offset error. The result is a server-side crash that terminates the PocketMine-MP process and disconnects all connected players. The flaw is categorized as improper validation of array index [CWE-129].

Critical Impact
Any low-privileged player with network access to a vulnerable PocketMine-MP server can remotely crash the server by sending crafted banner NBT data containing an invalid dye color ID.

Affected Products

PocketMine-MP versions prior to 4.8.1
Servers exposing Minecraft: Bedrock Edition multiplayer endpoints
Any deployment permitting inventory transactions or command execution by authenticated players

Discovery Timeline

2026-09-09 - CVE-2023-54396 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2023-54396

Vulnerability Analysis

The vulnerability resides in the DyeColorIdMap class within src/data/bedrock/DyeColorIdMap.php. The fromId() method performed a direct array lookup against the $idToEnum map without checking whether the supplied integer key existed. When a client submitted banner NBT data referencing a dye color ID outside the valid range, PHP raised an undefined offset error during deserialization. The unhandled error propagated up the deserialization stack and terminated the server process.

Banner items in Minecraft: Bedrock Edition carry NBT metadata describing pattern layers, and each layer references a dye color by numeric ID. Because the deserializer trusted client-supplied integers, an attacker could weaponize any code path that reconstructs banner state.

Root Cause

The root cause is missing bounds validation on an attacker-controlled array index [CWE-129]. The fromId() method assumed the caller had already validated the ID, but deserialization routines forwarded raw values from client packets directly into the lookup.

Attack Vector

Exploitation requires an authenticated session on the target PocketMine-MP server. An attacker connects as a normal player and either performs an inventory transaction involving a crafted banner item, or issues a command that instantiates a banner with an invalid dye color ID. The malformed NBT is deserialized server-side, triggering the undefined offset and crashing the process.

php

// Patch: src/data/bedrock/DyeColorIdMap.php
public function fromId(int $id) : ?DyeColor{
-    return $this->idToEnum[$id];
+    return $this->idToEnum[$id] ?? null;
}

public function fromInvertedId(int $id) : ?DyeColor{

Source: PocketMine-MP commit 08b9495. The fix adds a null-coalescing operator so unknown IDs return null instead of raising an undefined offset error. Callers are then responsible for handling the null result gracefully.

Detection Methods for CVE-2023-54396

Indicators of Compromise

Unexpected PocketMine-MP process termination coinciding with player inventory activity or banner-related commands
PHP undefined offset errors referencing DyeColorIdMap::fromId in server logs
Repeated abnormal disconnections of all players followed by service restart events
Inbound Minecraft Bedrock protocol packets containing banner NBT with out-of-range dye color IDs

Detection Strategies

Parse PocketMine-MP crash dumps and PHP error logs for stack traces originating in src/data/bedrock/DyeColorIdMap.php
Alert on process supervisor restart loops for the PocketMine-MP service within short time windows
Correlate player join events with subsequent server crashes to identify a probable attacker account
Monitor for repeated ItemStackRequest or command packets from a single source preceding a crash

Monitoring Recommendations

Forward PocketMine-MP application logs and PHP fatal error output to a centralized logging platform
Track server uptime and mean time between crashes as a service-health signal
Enable packet-level logging during incident triage to capture the offending NBT payload

How to Mitigate CVE-2023-54396

Immediate Actions Required

Upgrade PocketMine-MP to version 4.8.1 or later on all production and staging servers
Restrict server access to trusted players using an allowlist while patching is in progress
Review server operator commands and plugins that construct banner items from user input
Enable automatic process supervision so the server restarts quickly if a crash occurs

Patch Information

The fix is delivered in PocketMine-MP 4.8.1 and applied in commit 08b9495bce2d65a6d1d3eeb76e484499a00765eb. Additional details are available in the GitHub Security Advisory GHSA-wqqv-jcfr-9f5g and the VulnCheck advisory.

Workarounds

Disable or block commands that allow players to spawn or modify banner items until patched
Apply the one-line change to DyeColorIdMap::fromId() as a temporary hotfix if upgrading is not immediately possible
Use rate limiting or connection throttling to slow repeated exploitation attempts from a single client

bash

# Upgrade PocketMine-MP to the patched release
composer require pocketmine/pocketmine-mp:^4.8.1

# Verify installed version
php -r "require 'vendor/autoload.php'; echo pocketmine\\VersionInfo::BASE_VERSION;"