What’s Vulnerable › Vulnerabilities

CVE-2026-86200: PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-08
• Weakness: CWE-779

Description

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

Affected products

• pmmp PocketMine-MP: before 5.42.1 — fixed in 5.42.1

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 5.42.1. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7
• https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt

Get alerted when CVE-2026-86200 or the next vulnerability affects your stack