Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-86201 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0	[email protected]	Source CodeVendor
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h	[email protected]	AdvisoryExploitRemedyVendor
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.41.1-logdos-via-loginpacket-clientdata	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-400	Uncontrolled Resource Consumption	[email protected]

Affected Products

Product	Versions
PocketMine-MP	< 5.41.1 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 5.41.1moderate effort Workaround:moderate effort Plugins can handle the DataPacketReceiveEvent to capture LoginPacket and pre-process the clientData JWT to ensure it doesn't have any unusual properties. This can be achieved using JsonMapper and setting the bExceptionOnUndefinedProperty flag to true. A JsonMapper_Exception will be thrown if the JWT is problematic. Note that this approach may cause login failures if unexpected properties appear in future versions.

Product

Versions

PocketMine-MP

< 5.41.1 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 5.41.1moderate effort
Workaround:moderate effort
Plugins can handle the DataPacketReceiveEvent to capture LoginPacket and pre-process the clientData JWT to ensure it doesn't have any unusual properties. This can be achieved using JsonMapper and setting the bExceptionOnUndefinedProperty flag to true. A JsonMapper_Exception will be thrown if the JWT is problematic. Note that this approach may cause login failures if unexpected properties appear in future versions.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 14, 2026	CVE Modified	CISA-ADP
Sep 9, 2026	New CVE Received	[email protected]