CVE-2026-86200

Deferred Deferred - Pending Action

Denial of Service in PocketMine-MP via Malicious LoginPacket

Publication date: 2026-09-09

Last updated on: 2026-09-18

Assigner: VulnCheck

Description

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-18

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86200

EUVD

EUVD-2026-74911

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	mp	to 5.42.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-779	The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

Attack-Flow Graph

Executive Summary

CVE-2026-86200 is a denial of service vulnerability in PocketMine-MP versions before 5.42.1. It allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT during login. This wastes server CPU time and degrades performance by forcing excessive logging.

Detection Guidance

Monitor server logs for excessive warning messages from LoginPacket handling. Check for repeated entries indicating unknown properties in clientData JWT. Use network traffic analysis tools to detect large or malformed login packets targeting the server.

Impact Analysis

This vulnerability can degrade server performance by consuming CPU resources with unnecessary logging. Servers exposed to public networks may experience slowdowns or crashes due to the flood of warning messages triggered by crafted login packets.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial of service through excessive logging and CPU consumption. It does not directly violate GDPR or HIPAA but could indirectly affect compliance by degrading system performance for healthcare or personal data processing environments.

Mitigation Strategies

Upgrade PocketMine-MP to version 5.42.1 or later to apply the official patch. Alternatively, configure JsonMapper to reject undefined properties by setting bExceptionOnUndefinedProperty to true in plugins processing clientData JWT.

Hi! I’m here to help you understand CVE-2026-86200. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70