---
id: CVE-2023-54395
title: >-
  PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability
  in ModalFormResponsePacket processing that allows attackers to cause server
  resource exhaustion by sending large JSON payloads
summary: >-
  PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability
  in ModalFormResponsePacket processing that allows attackers to cause server
  resource exhaustion by sending large JSON payloads. Attackers can send
  numerous ov…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-407
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 4.12.5
published: '2026-09-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:17:24.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54395'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/3baa5ab71214f96e6e7ab12cb9beef08118473b5
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7m9r-rq9j-wmmh
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.5-denial-of-service-via-modalformresponsepacket
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:18:50.794488Z'
ingestedAt: '2026-09-09T14:11:29.381Z'
epss: 0.0033
epssPercentile: 0.23594
---

## Overview

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.