# CVE-2023-54390

## Summary

- **CVE ID:** CVE-2023-54390
- **Severity:** HIGH
- **CVSS Score:** 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-1025
- **Published:** Sep 9, 2026
- **Last Modified:** Sep 9, 2026

## Description

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.

## Affected Products

No affected products listed.

## References

- [CNA](https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-92jh-gwch-jq38)
- [CNA](https://github.com/pmmp/PocketMine-MP/commit/4f90e8dab1c9df331fad7d3d89823404e882668c)
- [CNA](https://www.vulncheck.com/advisories/pocketmine-mp-before-5.3.1-denial-of-service-via-loginpacket)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._