CVE-2026-86201
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 9, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 5, 2026
Description
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
PocketMine-MPpmmp |
|
References
- GitHub Security Advisory (GHSA-h6rj-3m53-887h)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientDatathird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.