What’s Vulnerable › Vulnerabilities

CVE-2026-86198: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-10
• Weakness: CWE-837

Description

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Affected products

• Packagist Pocketmine/Pocketmine-Mp: before 5.44.2; 3.0.0, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2 (+382) — fixed in 5.44.2
• pmmp PocketMine-MP: before 5.44.2 — fixed in 5.44.2

How to fix

Upgrade to a fixed version: Packagist Pocketmine/Pocketmine-Mp 5.44.2; pmmp PocketMine-MP 5.44.2. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv
• https://www.vulncheck.com/advisories/pocketmine-mp-before-5.44.2-denial-of-service-via-resourcepackclientresponsepacket

Get alerted when CVE-2026-86198 or the next vulnerability affects your stack