CVE-2026-86201

    Dashboard / Vulnerabilities / CVE-2026-86201

    CVE-2026-86201

    Published: 9 Sept 2026Last Modified: 11 Sept 2026

    Summary: PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

    Details: PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86201.json, https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h, https://nvd.nist.gov/vuln/detail/CVE-2026-86201, https://www.vulncheck.com/advisories/pocketmine-mp-before-5.41.1-logdos-via-loginpacket-clientdata, https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ddb447b5cea1ba139b520fe05b570b3ee590d575

    Affected versions

    5.41.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86201 | CVE-DB