{"id":"CVE-2026-86202","state":"PUBLISHED","title":"PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket","description":"PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.","publishedAt":"2026-09-09T13:32:03.254Z","updatedAt":"2026-10-08T15:25:47.601Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["pmmp PocketMine-MP"],"affected":[{"vendor":"pmmp","product":"PocketMine-MP","packageURL":"pkg:composer/pocketmine/pocketmine-mp","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.39.2","versionType":"semver"},{"version":"5.39.2","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f","https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5","https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket"],"weaknesses":["CWE-406"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/86xxx/CVE-2026-86202.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-86202","state":"PUBLISHED","datePublished":"2026-09-09T13:32:03.254Z","dateUpdated":"2026-10-08T15:25:47.601Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-05T11:52:36.821Z"},"containers":{"cna":{"title":"PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket","descriptions":[{"lang":"en","value":"PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources."}],"affected":[{"vendor":"pmmp","product":"PocketMine-MP","packageURL":"pkg:composer/pocketmine/pocketmine-mp","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.39.2","versionType":"semver"},{"version":"5.39.2","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-7hmv-4j2j-pp6f)"},{"url":"https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5","tags":["patch"],"name":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket","name":"VulnCheck Advisory: PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-406","lang":"en","description":"Insufficient Control of Network Message Volume (Network Amplification)","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-08T15:25:47.601Z"},"datePublic":"2026-04-04T00:00:00.000Z","credits":[{"lang":"en","value":"dktapps","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-09T14:35:48.114658Z","id":"CVE-2026-86202","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-09T14:45:30.860Z"}}]}}}