CVE-2026-86201 pmmp CVE debrief

Who should care

Server administrators and security teams responsible for managing PocketMine-MP installations should assess their exposure and prioritize updating to version 5.41.1 or later to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-86201 is a denial-of-service vulnerability in PocketMine-MP before version 5.41.1. Server administrators and security teams should prioritize verifying and updating installations to prevent potential attacks. The vulnerability is caused by excessive logging without sanitization in LoginPacket processing, which can lead to out-of-memory conditions and server crashes. Verification of affected versions, exploitation, and remediation details is required from official sources.

• Potential server crashes due to out-of-memory conditions
• Excessive logging without sanitization
• Denial-of-service attacks via crafted LoginPackets

Technical summary

PocketMine-MP before version 5.41.1 contains a denial-of-service vulnerability in LoginPacket processing. Large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization, leading to potential out-of-memory conditions and server crashes. The vulnerability allows attackers to send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server. Server administrators and security teams should prioritize verifying and updating PocketMine-MP installations to prevent potential denial-of-service attacks.

Defensive priority

Server administrators and security teams should prioritize verifying and updating PocketMine-MP installations to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify PocketMine-MP installations and update to version 5.41.1 or later
• Implement input validation and sanitization for LoginPacket processing
• Monitor server logs for excessive logging and out-of-memory conditions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide information about a denial-of-service vulnerability in PocketMine-MP before version 5.41.1. The vulnerability is caused by excessive logging without sanitization in LoginPacket processing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.