CVE-2026-86204
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-400
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- pmmp PocketMine-MP
- pmmp PocketMine-MP
Weakness type
Related vulnerabilities
- CVE-2026-22591 — Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
- CVE-2026-86201 — PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
- CVE-2025-71418 — PocketMine-MP before 5.25.2 Denial of Service via explode
- CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-82001 — Acrobat Reader | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-76000 — ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-83968 — Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-72923 — Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion