CVE-2026-86202

Deferred Deferred - Pending Action

Network Amplification in PocketMine-MP via ActorEventPacket

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86202

EUVD

EUVD-2026-74913

Affected Vendors & Products

Vendor	Product	Version / Range
pocketmine	pocketmine-mp	to 5.39.2 (exc)
pocketmine	mp	to 5.39.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-406	The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-86202 is a network amplification vulnerability in PocketMine-MP, a Minecraft: Bedrock Edition server software. It involves the ActorEventPacket, which triggers consuming animations like eating or drinking based on client input. Attackers exploit this by sending malicious packets, causing the server to broadcast animation events to all visible players. This wastes CPU, memory, and network resources.

Detection Guidance

Monitor network traffic for excessive ActorEventPacket messages using packet inspection tools like Wireshark or tcpdump. Check server logs for unusual animation event broadcasts or spikes in CPU/memory usage. Use network monitoring tools to detect abnormal packet volumes from clients.

Impact Analysis

If you run a PocketMine-MP server before version 5.39.2, attackers can exploit this to overload your server with unnecessary animation events. This leads to high CPU and memory usage, potentially causing lag or crashes. Players may experience disrupted gameplay due to server performance issues.

Compliance Impact

This vulnerability primarily impacts server resource consumption and integrity rather than direct data exposure, so it does not directly violate GDPR or HIPAA. However, excessive resource usage could lead to service disruptions, potentially affecting availability requirements under these standards.

Mitigation Strategies

Upgrade PocketMine-MP to version 5.39.2 or later to apply the official patch.
Install a plugin to rate-limit ActorEventPacket processing as a temporary workaround.
Block or filter malicious ActorEventPacket traffic at the network firewall if possible.

Hi! I’m here to help you understand CVE-2026-86202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70