Medium severity6.5NVD Advisory· Published Sep 9, 2026· Updated Sep 9, 2026

CVE-2023-54396

Description

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pmmp/Pocketmine Mpllm-fuzzy2 versions
<4.8.1+ 1 more
- (no CPE)range: <4.8.1
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/pmmp/PocketMine-MP/commit/08b9495bce2d65a6d1d3eeb76e484499a00765ebnvd
github.com/pmmp/PocketMine-MP/security/advisories/GHSA-wqqv-jcfr-9f5gnvd
www.vulncheck.com/advisories/pocketmine-mp-before-4.8.1-server-crash-via-banner-nbtnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000