What’s Vulnerable › Vulnerabilities

CVE-2026-86203: PocketMine-MP before 5.39.2 Item Duplication via Despawn State

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-08
• Weakness: CWE-664

Description

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.

Affected products

• pmmp PocketMine-MP: before 5.39.2 — fixed in 5.39.2

How to fix

Upgrade to a fixed version: pmmp PocketMine-MP 5.39.2. Check the vendor advisory for mitigations.

References

• https://github.com/pmmp/PocketMine-MP/commit/c0719b76b18f2508143134e79bc9f1aa39109683
• https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-f9jp-856v-8642
• https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-item-duplication-via-despawn-state

Get alerted when CVE-2026-86203 or the next vulnerability affects your stack