CVE-2023-54392

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions 4.20.0 through 4.22.2 PocketMine-MP versions 5.0.0 through 5.2.0

Description Failure to validate NBT tag types in the BlockActorDataPacket allows a player to crash the server. By sending a packet containing sign NBT data with an incorrect tag type, an unhandled UnexpectedTagTypeException is triggered, which terminates the server process. This occurs when the server expects a CompoundTag but receives a different type, such as a ByteTag, specifically within the FrontText variable.

Recommendations Update to version 4.22.3 or newer. Update to version 5.2.1 or newer. As a temporary workaround, use a plugin to handle DataPacketReceiveEvent for BlockActorDataPacket and verify that the FrontText tag is a TAG Compound.