CVE-2023-54394CWE-770denial-of-service

CVE-2023-54394

Medium · published September 9, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00379 · 30.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-09T18:17Z
References (3)
https://github.com/pmmp/PocketMine-MP/commit/ca6d51498f12427a947467da8fcad7811418e6cc · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-4.18.0-alpha2-bandwidth-amplification-via-inventorytransactionpacket · [email protected]
EPSS history
Timeline
  • 11 SEP 03:12Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:31Z
    PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
    cvelistv5