The vulnerability arises because PocketMine-MP versions before 5.3.1 and 4.23.1 do not check that the identityPublicKey in the LoginPacket uses the mandated secp384r1 elliptic curve. A forged packet can include a key on a different curve or a non‑EC key, bypassing authentication. During key derivation, an unhandled exception is thrown, crashing the server. This Denial‑of‑Service flaw is categorized as CWE‑347. No escalation of privilege occurs, but the availability of the gaming server is compromised.

Affected systems are servers running PocketMine‑MP earlier than version 5.3.1 or 4.23.1. These versions are used by community‑run Minecraft Bedrock servers and similar hosting environments. The flaw is present across all builds that rely on the vulnerable login handling code until the patched releases.

The CVSS score of 8.7 indicates a high severity attack. With no EPSS value provided and the vulnerability not listed in the KEV catalog, the exact likelihood of exploitation remains unknown, but the flaw can be triggered remotely via standard client connections, as attackers can send a crafted LoginPacket from any network. The lack of a server‑side validation step makes manual exploitation trivial, and once triggered the server terminates, requiring a restart to resume service.