Every CVE Search/ Get API key

CVE-2023-54392

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

7.1 HighFix available

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.53%Up 0.2 points since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Record
CVE-2023-54392
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2023-60622 7.1

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Record
EUVD-2023-60622
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7wrv-6h42-w54f 7.5

PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket

Summary

A player sending a packet can cause the server to crash by providing incorrect sign data in NBT in BlockActorDataPacket.

Details

This vulnerability was discovered using the BlockActorDataPacket, but other packets may also be affected. The player would seem to just need to send an NBT with an incorrect type to throw this error.

[Server thread/CRITICAL]: pocketmine\nbt\UnexpectedTagTypeException: "Expected a tag of type pocketmine\nbt\tag\CompoundTag, got pocketmine\nbt\tag\ByteTag" (EXCEPTION) in "pmsrc/vendor/pocketmine/nbt/src/tag/CompoundTag" at line 107
--- Stack trace ---
  #0 pmsrc/src/network/mcpe/handler/InGamePacketHandler(751): pocketmine\nbt\tag\CompoundTag->getCompoundTag(string[9] FrontText)
  #1 pmsrc/vendor/pocketmine/bedrock-protocol/src/BlockActorDataPacket(50): pocketmine\network\mcpe\handler\InGamePacketHandler->handleBlockActorData(object pocketmine\network\mcpe\protocol\BlockActorDataPacket#220241)
  #2 pmsrc/src/network/mcpe/NetworkSession(433): pocketmine\network\mcpe\protocol\BlockActorDataPacket->handle(object pocketmine\network\mcpe\handler\InGamePacketHandler#190572)

PoC

Use a bot or proxy to send a packet when editing a sign. This packet should contain an NBT with incorrect types but correct architecture.

Impact

This makes it possible to shutdown a server for someone who knows how to operate it. As this was discovered in 4.22.1, everyone with at least this version is affected.

Patches

This bug was fixed by 0c250a2ef09627b48aa52302f6cc7e1f2afb70ea in the 4.22.3 and 5.2.1 releases.

Workarounds

A plugin may be able to handle DataPacketReceiveEvent for BlockActorDataPacket, and verify that the FrontText tag is a TAG_Compound.

Record
GHSA-7wrv-6h42-w54f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j32g-gv5r-qc39 7.1

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to...

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Record
GHSA-j32g-gv5r-qc39
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 7.1

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Record
CVE-2023-54392
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 7.1

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process.

Record
CVE-2023-54392
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-7wrv-6h42-w54f 7.5

PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket

Summary

A player sending a packet can cause the server to crash by providing incorrect sign data in NBT in BlockActorDataPacket.

Details

This vulnerability was discovered using the BlockActorDataPacket, but other packets may also be affected. The player would seem to just need to send an NBT with an incorrect type to throw this error.

[Server thread/CRITICAL]: pocketmine\nbt\UnexpectedTagTypeException: "Expected a tag of type pocketmine\nbt\tag\CompoundTag, got pocketmine\nbt\tag\ByteTag" (EXCEPTION) in "pmsrc/vendor/pocketmine/nbt/src/tag/CompoundTag" at line 107
--- Stack trace ---
  #0 pmsrc/src/network/mcpe/handler/InGamePacketHandler(751): pocketmine\nbt\tag\CompoundTag->getCompoundTag(string[9] FrontText)
  #1 pmsrc/vendor/pocketmine/bedrock-protocol/src/BlockActorDataPacket(50): pocketmine\network\mcpe\handler\InGamePacketHandler->handleBlockActorData(object pocketmine\network\mcpe\protocol\BlockActorDataPacket#220241)
  #2 pmsrc/src/network/mcpe/NetworkSession(433): pocketmine\network\mcpe\protocol\BlockActorDataPacket->handle(object pocketmine\network\mcpe\handler\InGamePacketHandler#190572)

PoC

Use a bot or proxy to send a packet when editing a sign. This packet should contain an NBT with incorrect types but correct architecture.

Impact

This makes it possible to shutdown a server for someone who knows how to operate it. As this was discovered in 4.22.1, everyone with at least this version is affected.

Patches

This bug was fixed by 0c250a2ef09627b48aa52302f6cc7e1f2afb70ea in the 4.22.3 and 5.2.1 releases.

Workarounds

A plugin may be able to handle DataPacketReceiveEvent for BlockActorDataPacket, and verify that the FrontText tag is a TAG_Compound.

Record
GHSA-7wrv-6h42-w54f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pocketmine/pocketmine-mp
Packagist
 4.20.0 up to 4.22.3
4.22.3
pocketmine/pocketmine-mp
Packagist
 5.0.0 up to 5.2.1
5.2.1
pocketmine/pocketmine-mp
Packagist
 4.20.0 up to 4.22.3, plus listed versions
4.20.14.20.24.20.34.20.44.20.5
Show 5 moreShow less
4.21.04.21.14.22.04.22.14.22.2
4.22.3
pocketmine/pocketmine-mp
Packagist
 5.0.0 up to 5.2.1, plus listed versions
5.0.15.1.05.1.15.1.25.1.35.2.0
5.2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-54392 is a high vulnerability (CVSS 7.1) in Pmmp Pocketmine-mp, published July 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in pocketmine/pocketmine-mp 4.22.3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open