PocketMine-MP: 18 DoS Vulnerabilities Disclosed in Coordinated Batch
Key findings • 18 denial-of-service and resource exhaustion vulnerabilities disclosed for PocketMine-MP on September 9, 2026. • Multiple vulnerabilities stem from improper handling of LoginPa…
Key findings
- 18 denial-of-service and resource exhaustion vulnerabilities disclosed for PocketMine-MP on September 9, 2026.
- Multiple vulnerabilities stem from improper handling of LoginPacket and ModalFormResponsePacket data.
- Flaws affect both 4.x and 5.x branches, with patches available in various specific versions.
- High severity vulnerabilities include unauthenticated server crashes and denial of service via crafted packets.
- Exploits target packet parsing, JSON handling, authentication, and resource management.
On September 9, 2026, a significant batch of 18 vulnerabilities was disclosed for PocketMine-MP, a popular Minecraft Pocket Edition server software. These vulnerabilities, all disclosed on the same day, primarily revolve around denial-of-service (DoS) and resource exhaustion attacks, with several rated as High severity. The disclosures highlight critical flaws in packet handling, JSON parsing, and authentication mechanisms within PocketMine-MP versions prior to various specific releases.
Several vulnerabilities stem from inadequate handling of LoginPacket data. CVE-2026-86201, CVE-2026-86200, CVE-2024-58381, CVE-2023-54395, and CVE-2023-54390 all detail how crafted LoginPackets, containing malformed JSON, excessively nested structures, or improper null value handling, can lead to server crashes or resource exhaustion. Specifically, CVE-2026-86199 allows unauthenticated players to crash the server by triggering an uninitialized property access error during offline login authentication due to improper certificate field validation. Furthermore, CVE-2023-54355 points out that failure to validate the elliptic curve used in the identityPublicKey of LoginPackets can lead to uncaught exceptions during key derivation.
Another group of vulnerabilities targets ModalFormResponsePacket and related packet handling. CVE-2026-86204 and CVE-2023-54395 describe how unauthenticated players can exploit flaws in ModalFormResponsePacket handling by sending oversized JSON payloads, leading to denial of service through memory and CPU resource exhaustion. CVE-2026-86202 highlights a network amplification vulnerability in ActorEventPacket handling, allowing clients to spam animation events to other players, consuming server resources. Additionally, CVE-2026-86198 involves the improper validation of multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED, enabling malicious clients to amplify resource usage by repeatedly triggering pre-spawn progression. CVE-2025-71417 also relates to ResourcePackClientResponsePacket, where failure to validate pack UUID uniqueness can lead to duplicate pack transmissions and memory exhaustion.
Other notable vulnerabilities include CVE-2026-86203, which exploits a race condition in entity despawn state validation when processing attack packets, allowing for inventory duplication. CVE-2024-58380 details a crash in BookEditPacket handling due to an invalid inventory slot value. CVE-2023-54396 points to an issue with dye color ID validation in banner NBT data, leading to server crashes. CVE-2023-54394 describes how a lack of rate-limiting on InventoryTransactionPacket requests can cause excessive inventory synchronization and data transmission. Finally, CVE-2023-54392 highlights a vulnerability in BlockActorDataPacket where incorrect NBT tag types in sign data can lead to server termination.
The affected versions span across both the 4.x and 5.x branches of PocketMine-MP, with patches released in versions such as 5.39.2, 5.41.1, 5.42.1, 5.43.1, 5.44.2, 5.25.2, 5.11.1, 5.11.2, 4.8.1, 4.12.5, 4.18.0-ALPHA2, 4.20.5, 4.22.3, 5.2.1, 5.3.1, and 4.23.1. Users are strongly advised to update to the patched versions to mitigate these risks.
This coordinated disclosure of numerous denial-of-service vulnerabilities underscores the importance of robust input validation and resource management in server software. Players running PocketMine-MP servers should prioritize updating to the latest available versions to protect against these widespread exploits that could lead to server instability and data duplication. The sheer volume and variety of packet-handling flaws suggest a need for ongoing vigilance in securing network-facing applications.