Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-86202

PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pmmp PocketMine-MP

Default version status: unaffected

  • 0 to < 5.39.2affected
  • 5.39.2unaffected
pkg:composer/pocketmine/pocketmine-mp

References