PT-2025-54457 · Unknown · Pocketmine-Mp

Published 2025-12-31 · Updated 2026-01-02 · CVE-2023-7332

Positive Technologies · (AI Summary)

CVSS v4.0

7.1

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.18.1

Description PocketMine-MP versions prior to 4.18.1 have an issue with how input is checked when handling inventory transactions. A remote attacker who has a valid player session can ask the server to drop more items than the player actually has in their hotbar. This can cause the server to crash, leading to a denial of service.

Recommendations Update to PocketMine-MP version 4.18.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2023-7332

Affected Products

Pocketmine-Mp

References · 9

• 🔥 https://github.com/pmmp/PocketMine-MP/blob/4.18.1/changelogs/4.18.md · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/commit/5897476 · Exploit
• 🔥 https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h87r-f4vc-mchv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7332 · Security Note
• https://t.me/CVEtracker/41128 · Telegram Post
• https://vulncheck.com/advisories/pocketmine-mp-improper-validation-of-dropped-item-count-allows-remote-server-crash · Note
• https://t.me/cveNotify/147555 · Telegram Post
• https://twitter.com/CVEnew/status/2006495357685891273 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006550707042685098 · Twitter Post