CVE-2023-54394

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.18.0-ALPHA2

Description The software fails to rate-limit InventoryTransactionPacket requests of the mismatch type. This allows an unauthenticated attacker to trigger excessive inventory synchronization by sending numerous mismatch transactions, forcing the server to transmit large amounts of serialized inventory data. This process acts as a bandwidth multiplier, consuming significant server bandwidth, particularly when dealing with large amounts of NBT (Named Binary Tag), which is a structured data format used to store item properties.

Recommendations Update to version 4.18.0-ALPHA2 or later. As a temporary workaround, use plugins to handle DataPacketReceiveEvent for InventoryTransactionPacket and apply a rate limit to MismatchTransactionData, such as a maximum of one request per tick.