CVE-2026-86204 Details
Description
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
A denial-of-service vulnerability has been identified in PocketMine-MP versions prior to 5.39.2. The issue arises because the server fails to properly limit the size of JSON payloads in ModalFormResponsePacket handling. This allows authenticated players to send modal form response packets containing large JSON arrays, which can exhaust the server's memory and CPU resources, causing the server to become unresponsive. The vulnerability can be exploited by players with a full session on the server.
Users can update to PocketMine-MP version 5.39.2 or later, where this vulnerability has been fixed. The issue was addressed by implementing a 10 KB limit on form response sizes and ensuring that form responses are only decoded if a valid form ID is associated with them.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PocketMine-MP | < 5.39.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |