{"action":"Upgrade pocketmine/pocketmine-mp to 4.18.0-ALPHA2 or later.","affected":[{"fixed":"4.18.0-ALPHA2","introduced":"0"}],"component":"pocketmine/pocketmine-mp","cve_ids":["CVE-2023-54394"],"ecosystem":"Packagist","epss":0.00531,"exploited":false,"fixed_versions":["4.18.0-ALPHA2"],"ghsa_id":"GHSA-42qm-8v8m-m78c","id":"tcs_01M5KETEXY74NE6113Y36987QC","modified_at":"2026-09-10T03:56:11.632913392Z","published_at":"2023-06-01T19:10:40Z","references":["https://osv.dev/vulnerability/GHSA-42qm-8v8m-m78c","https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-42qm-8v8m-m78c","https://github.com/pmmp/PocketMine-MP","https://github.com/pmmp/PocketMine-MP/blob/4.18.0-ALPHA2/changelogs/4.18-alpha.md#4180-ALPHA2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-42qm-8v8m-m78c","url":"https://osv.dev/vulnerability/GHSA-42qm-8v8m-m78c"}],"summary":"PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'"}