CVE-2026-86198 Details
Description
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
A denial-of-service vulnerability has been identified in PocketMine-MP versions prior to 5.44.2. The issue arises during resource pack management, where the server fails to properly validate multiple ResourcePackClientResponsePacket packets marked as STATUS_COMPLETED. This flaw allows malicious clients to send batches of these packets, repeatedly triggering pre-spawn processes. As a result, duplicate Player objects are created, leading to increased memory usage and higher network traffic.
Users can update to PocketMine-MP version 5.44.2 or later, where this vulnerability has been patched. Alternatively, plugins can implement their own PacketHandler classes to reject or ignore any additional ResourcePackClientResponsePacket packets.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-837 | Improper Enforcement of a Single, Unique Action | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PocketMine-MP | < 5.44.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |