CVE-2023-54394
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CWE
- CWE-770
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- pmmp PocketMine-MP
- pmmp PocketMine-MP
Weakness type
Related vulnerabilities
- CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-86075 — n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
- CVE-2026-57099 — ASP.NET Core Denial of Service Vulnerability
- CVE-2026-69374 — Windows SMB Server Denial of Service Vulnerability
- CVE-2026-72978 — Active Directory Federation Services (AD FS) Denial of Service Vulnerability
- CVE-2026-82075 — Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
- CVE-2026-82054 — Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
- CVE-2026-62649 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does...