CVE-2026-86202: PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-10-08
Weakness: CWE-406

Description

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

Affected products

pmmp PocketMine-MP: before 5.39.2 — fixed in 5.39.2

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 5.39.2. Check the vendor advisory for mitigations.

References

https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket

Get alerted when CVE-2026-86202 or the next vulnerability affects your stack