{"id":"CVE-2023-54390","aliases":["GHSA-92jh-gwch-jq38"],"url":"https://o3.security/vulnerability/CVE-2023-54390","summary":"PocketMine-MP before 5.3.1 Denial of Service via LoginPacket","details":"### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in `LoginPacket`.\n\nThis happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect.\n\n Code processing arrays in the JSON data could then crash due to unexpected `NULL` elements.\n\n### Patches\nThis problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c\n\nAn upstream patch for this issue was proposed via https://github.com/cweiske/jsonmapper/pull/211; however, as of 2024-05-15, the patch has not been accepted upstream due to debate about how to deal with the behavior. For now, a fork of JsonMapper is used by PocketMine-MP to workaround the issue.\n\n### Workarounds\nA plugin may handle `DataPacketReceiveEvent` for `LoginPacket` and check that none of the input arrays contain `NULL` where it's not expected, but this is rather cumbersome.\n\n### References\nProposed upstream patch for a behavior change: https://github.com/cweiske/jsonmapper/pull/211","published":"2026-09-09T13:31:50.742Z","modified":"2026-10-28T02:31:09.317781135Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"5.3.1"},{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"4.23.1"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c","label":"pmmp/PocketMine-MP@4f90e8d"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54390.json"},{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54390"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket"},{"type":"FIX","url":"https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c"},{"type":"WEB","url":"https://github.com/pmmp/netresearch-jsonmapper/commit/4f90e8dab1c9df331fad7d3d89823404e882668c"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:09.317781135Z"}}