CVE-2023-54393

PocketMine-MP versions before 4.20.5 fail to properly validate JSON supplied in the LoginPacket during client login, stemming from improper input handling in the JsonMapper dependency. An unauthenticated attacker on the network can send malformed or deeply structured JSON within a login attempt, crashing the Minecraft Bedrock server process. The impact is availability only: an attacker gains repeated remote denial of service (requiring a server restart) but, per the CVSS 4.0 vector, no data theft or modification. Any operator running an affected PocketMine-MP release is exposed, since no privileges or user interaction are required. There is currently no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is known.

What to do: Upgrade PocketMine-MP to 4.20.5 or later. As interim mitigation, restrict access to the server's Bedrock game port to trusted networks and monitor for crash-inducing login traffic, restarting the service after any crash. Because the attack requires no authentication, patch promptly even though no public PoC or known exploitation exists.