CVE-2023-54390

PocketMine-MP, a PHP-based third-party server implementation for Minecraft: Bedrock Edition, contains a denial-of-service flaw in its handling of the LoginPacket, the JSON login payload sent by connecting clients. Versions before 5.3.1 and before 4.23.1 mishandle null values inside arrays during this JSON parsing (classified as CWE-1025, comparison of incompatible types), so a login packet containing unexpected null elements crashes the server. A remote, unauthenticated attacker can trigger this with a single malformed login packet, achieving a crash-level denial of service with no confidentiality or integrity impact (CVSS 4.0 8.7, High, availability impact only). Any operator running an affected 4.x or 5.x release, particularly internet-facing community servers, is exposed. There is no public proof-of-concept, the issue is not in CISA's KEV, and no exploitation is currently known.

What to do: Upgrade to PocketMine-MP 5.3.1 or later (or 4.23.1 or later if remaining on the 4.x branch). Until patched, limit exposure of the Bedrock UDP port (default 19132) to trusted clients or place a proxy/allowlist in front of the server, and monitor for crashes or restarts coinciding with login attempts.