CVE-2026-86198

    Dashboard / Vulnerabilities / CVE-2026-86198

    CVE-2026-86198

    Published: 9 Sept 2026Last Modified: 12 Sept 2026

    Summary: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

    Details: PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86198.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-pg53-p7qp-65cv, https://nvd.nist.gov/vuln/detail/CVE-2026-86198, https://www.vulncheck.com/advisories/pocketmine-mp-before-5.44.2-denial-of-service-via-resourcepackclientresponsepacket, https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -439c8f2ef527fe2732afaa87872c46194b91b02d

    Affected versions

    5.43.2
    5.43.1
    5.43.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86198 | CVE-DB