---
id: CVE-2023-54390
title: >-
  PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service
  vulnerability in LoginPacket JSON parsing due to improper null value handling
  in arrays
summary: >-
  PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service
  vulnerability in LoginPacket JSON parsing due to improper null value handling
  in arrays. Attackers can send malformed JSON with unexpected null elements in
  LoginP…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1025
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:20:21.673'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54390'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T14:09:45.573013Z'
ingestedAt: '2026-09-09T14:11:29.381Z'
epss: 0.00339
epssPercentile: 0.24634
---

## Overview

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.