{"id":"CVE-2023-54392","aliases":["GHSA-7wrv-6h42-w54f"],"url":"https://o3.security/vulnerability/CVE-2023-54392","summary":"PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket","details":"### Summary\nA player sending a packet can cause the server to crash by providing incorrect sign data in NBT in `BlockActorDataPacket`.\n\n### Details\nThis vulnerability was discovered using the `BlockActorDataPacket`, but other packets may also be affected. The player would seem to just need to send an NBT with an incorrect type to throw this error.\n\n```\n[Server thread/CRITICAL]: pocketmine\\nbt\\UnexpectedTagTypeException: \"Expected a tag of type pocketmine\\nbt\\tag\\CompoundTag, got pocketmine\\nbt\\tag\\ByteTag\" (EXCEPTION) in \"pmsrc/vendor/pocketmine/nbt/src/tag/CompoundTag\" at line 107\n--- Stack trace ---\n  #0 pmsrc/src/network/mcpe/handler/InGamePacketHandler(751): pocketmine\\nbt\\tag\\CompoundTag->getCompoundTag(string[9] FrontText)\n  #1 pmsrc/vendor/pocketmine/bedrock-protocol/src/BlockActorDataPacket(50): pocketmine\\network\\mcpe\\handler\\InGamePacketHandler->handleBlockActorData(object pocketmine\\network\\mcpe\\protocol\\BlockActorDataPacket#220241)\n  #2 pmsrc/src/network/mcpe/NetworkSession(433): pocketmine\\network\\mcpe\\protocol\\BlockActorDataPacket->handle(object pocketmine\\network\\mcpe\\handler\\InGamePacketHandler#190572)\n```\n\n### PoC\nUse a bot or proxy to send a packet when editing a sign. This packet should contain an NBT with incorrect types but correct architecture.\n\n### Impact\nThis makes it possible to shutdown a server for someone who knows how to operate it. As this was discovered in 4.22.1, everyone with at least this version is affected.\n\n### Patches\nThis bug was fixed by 0c250a2ef09627b48aa52302f6cc7e1f2afb70ea in the 4.22.3 and 5.2.1 releases.\n\n### Workarounds\nA plugin may be able to handle `DataPacketReceiveEvent` for `BlockActorDataPacket`, and verify that the `FrontText` tag is a `TAG_Compound`.","published":"2026-09-09T13:31:51.436Z","modified":"2026-10-28T02:30:36.742232422Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"4.22.3"},{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"5.2.1"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea","label":"pmmp/PocketMine-MP@0c250a2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54392.json"},{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7wrv-6h42-w54f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54392"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-4.22.3-denial-of-service-via-blockactordatapacket"},{"type":"FIX","url":"https://github.com/pmmp/PocketMine-MP/commit/0c250a2ef09627b48aa52302f6cc7e1f2afb70ea"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:36.742232422Z"}}