CVE-2023-54392

    Dashboard / Vulnerabilities / CVE-2023-54392

    CVE-2023-54392

    Published: 9 Sept 2026Last Modified: 11 Sept 2026

    Summary: PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

    Details: PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54392.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f, https://nvd.nist.gov/vuln/detail/CVE-2023-54392, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.22.3-denial-of-service-via-blockactordatapacket, https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 54ae4d0ea2429bfb020aa1fae444c5ac9e3dcafb
    Fixed -8ebcdb452dac95cf727f6b515bd10ea0505215bd

    Affected versions

    5.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-54392 | CVE-DB