CVE-2026-86200
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CWE
- CWE-779
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- pmmp PocketMine-MP
- pmmp PocketMine-MP
Weakness type
Related vulnerabilities
- CVE-2026-20210 — Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
- CVE-2026-20209 — Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
- CVE-2026-28718 — Denial of service due to insufficient input validation in authentication logging. The following...
- CVE-2025-69230 — AIOHTTP Vulnerable to Cookie Parser Warning Storm
- CVE-2025-8696 — DoS attack against the Stork UI from an unauthenticated user
- CVE-2025-53636 — Open OnDemand Shell App closed websocket DoS
- CVE-2024-55628 — Suricata oversized resource names utilizing DNS name compression can lead to resource starvation
- CVE-2024-36416 — SuiteCRM v4 API Excessive log data DOS