Login Request a demo
Medium severity · published Sep 9, 2026
CVE-2023-54395
PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PocketMine-MP · pmmp
before 4.12.5 · source: vendor
Affected product
PO
PocketMine-MP
pmmp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-54395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-54395
vendor-advisory
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7m9r-rq9j-wmmh
patch
https://github.com/pmmp/PocketMine-MP/commit/3baa5ab71214f96e6e7ab12cb9beef08118473b5
third-party-advisory
https://www.vulncheck.com/advisories/pocketmine-mp-before-4.12.5-denial-of-service-via-modalformresponsepacket
More from PocketMine-MP
7.5
CVE-2026-86201
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
7.5
CVE-2026-86199
PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
7.5
CVE-2024-58381
PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
7.5
CVE-2023-54393
PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
7.5
CVE-2023-54390
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket