CVE-2023-54396 — PocketMine-MP before 4.8.1 Server Crash via Banner NBT
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transaction…
Published: 2026-09-09 · CVSS: 7.1 · CVSS 4.0
PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7