CVE-2026-86200
Received
Received - Intake
Denial of Service in PocketMine-MP via Malicious LoginPacket
Vulnerability report for CVE-2026-86200, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-09
Last updated on: 2026-09-09
Assigner: VulnCheck
Description
Description
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pocketmine | mp | to 5.42.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-779 | The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack. |
