CVE-2023-54390

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.3.1 PocketMine-MP versions prior to 4.23.1

Description A denial of service issue exists in the JSON parsing of the LoginPacket due to improper handling of null values within arrays. The json mapper accepts null type values in typed arrays, which the software does not expect. An attacker can send malformed JSON containing unexpected null elements in the LoginPacket to crash the server.

Recommendations Update to version 5.3.1. Update to version 4.23.1. As a temporary workaround, a plugin can handle the DataPacketReceiveEvent for LoginPacket to verify that input arrays do not contain unexpected null values.