CVE-2023-54394

    Dashboard / Vulnerabilities / CVE-2023-54394

    CVE-2023-54394

    Published: 9 Sept 2026Last Modified: 11 Sept 2026

    Summary: PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket

    Details: PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54394.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c, https://nvd.nist.gov/vuln/detail/CVE-2023-54394, https://www.vulncheck.com/advisories/pocketmine-mp-before-4.18.0-alpha2-bandwidth-amplification-via-inventorytransactionpacket, https://github.com/pmmp/PocketMine-MP/commit/ca6d51498f12427a947467da8fcad7811418e6cc

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -66a4c4c88b1d70d2705bf32e51d80802bdc651ae

    Affected versions

    4.18.0-ALPHA1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-54394 | CVE-DB