Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-86198

PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 5.44.2affected
  • 5.44.2unaffected

References