CVE-2026-86202 Details

A network amplification vulnerability has been identified in PocketMine-MP versions prior to 5.39.2. This vulnerability arises from the server's handling of ActorEventPacket messages, which are used to trigger consuming animations for players. Attackers can exploit this by sending crafted packets that cause the server to spam animation events to all visible players, thereby wasting CPU and memory resources. This issue is reminiscent of other vulnerabilities related to packet handling that were addressed in a previous network overhaul, but this particular vulnerability was not fixed.

Users can update to PocketMine-MP version 5.39.2 or later, where this vulnerability has been patched. The patch involves changing how consuming animations are handled, allowing the server to control the process entirely and discarding ActorEventPacket messages from clients.