CVE-2023-54393

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.20.5

Description A denial of service issue exists during the parsing of JSON in the LoginPacket due to improper validation within the JsonMapper dependency. The library fails to perform adequate checks when mapping JSON arrays and objects onto scalar model properties, such as strings. An attacker can exploit this by sending malformed JSON structures in the LoginPacket to crash the server.

Recommendations Update to version 4.20.5 or 4.21.1. For source installations, manually install the patched version of JsonMapper by backporting the specific fix commit. Use a plugin with DataPacketReceiveEvent to detect suspicious payloads and catch the ErrorException that occurs during a crash.