CVE-2026-86198 pmmp CVE debrief

Who should care

Server administrators and developers using PocketMine-MP should assess exposure and implement patches or workarounds to mitigate this vulnerability. This includes verifying and updating to version 5.44.2 or later, monitoring server performance and memory usage, and reviewing compensating controls for exposed systems.

Why it matters

Defenders should prioritize verifying and updating to version 5.44.2 or later to mitigate this vulnerability. Server administrators and developers using PocketMine-MP should assess exposure and implement patches or workarounds to prevent potential memory and network issues.

• Potential for increased memory usage due to repeated packet processing
• Amplified outbound network traffic from duplicated pre-spawn packets
• Possible server performance degradation or instability

Technical summary

The vulnerability occurs during the resource pack stage of logging in, where a malicious client can send multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED, causing the server to repeatedly execute pre-spawn progression. This leads to increased memory usage and amplified outbound network traffic. The issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in version 5.44.2. Server administrators and developers using PocketMine-MP should assess exposure and implement patches or workarounds.

Defensive priority

Defenders should prioritize verifying and updating to version 5.44.2 or later to mitigate this vulnerability. Server administrators and developers using PocketMine-MP should assess exposure and implement patches or workarounds.

Recommended defensive actions

• Verify and update PocketMine-MP to version 5.44.2 or later
• Implement plugins to reject or ignore extra ResourcePackClientResponsePacket packets
• Monitor server performance and memory usage for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in version 5.44.2. Plugins can use their own PacketHandler classes to reject or ignore extra ResourcePackClientResponsePacket packets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.