CVE-2023-54392

PocketMine-MP, an open-source PHP server implementation for Minecraft: Bedrock Edition, does not validate NBT tag types in BlockActorDataPacket in affected versions (4.20.0 through 4.22.2, and 5.x before 5.2.1). Any player connected to the server can send a block-actor (sign) NBT payload with an incorrect tag type, which raises an unhandled UnexpectedTagTypeException that terminates the server process. An attacker gains remote denial of service only, crashing the server and disconnecting all players; the CVSS vector shows no confidentiality or integrity impact, just a high availability impact. Operators of public or private Bedrock servers running PocketMine-MP in the affected ranges are affected, and servers open to the public are the most exposed because anyone who can join can trigger the crash. There is no known public proof-of-concept and no reported in-the-wild exploitation, and the flaw is not in the CISA KEV catalog.

What to do: Upgrade PocketMine-MP to 4.22.3 or later on the 4.x branch, or to 5.2.1 or later on the 5.x branch. Until patched, restrict server access to trusted players, since the crash requires an in-game connection, and monitor logs for UnexpectedTagTypeException. Verify the running version via the startup banner or server logs to confirm which branch is in use.