Network Amplification Vulnerability in PocketMine-MP by PocketMine Team
CVE-2026-86202

5.3MEDIUM

Key Information:

Vendor

Pmmp

Status
Pocketmine-mp
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86202?

PocketMine-MP versions earlier than 5.39.2 are susceptible to a network amplification vulnerability that arises during the handling of ActorEventPacket messages. This vulnerability enables attackers to send specially crafted packets, which can provoke excessive animation events for all visible players within the game. As a result, these attacks can lead to significant consumption of CPU and memory resources on the server, potentially degrading performance or causing service interruptions. It’s crucial for users to update to the latest version to mitigate these risks.

Affected Version(s)

PocketMine-MP 0 < 5.39.2

PocketMine-MP 5.39.2

References

https://github.com/pmmp/PocketMine-MP/security/advisories...
vendor-advisory
https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772...
patch
https://www.vulncheck.com/advisories/pocketmine-mp-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dktapps
.