CVE-2026-86200
PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 9, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 5, 2026
Description
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-779 Logging of Excessive Data
Affected Products
| Product | Versions |
|---|---|
PocketMine-MPpmmp |
|
References
- GitHub Security Advisory (GHSA-xp4f-g2cm-rhg7)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWTthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.