These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-86204 is a high-severity denial-of-service vulnerability affecting PocketMine-MP versions before 5.39.2. The issue arises from the failure to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service by sending massive JSON arrays that exhaust server memory and CPU resources. This vulnerability can be triggered by authenticated players [truncated]
CVE-2026-86203: PocketMine-MP before 5.39.2 Item Duplication via Despawn State. The CVE record was published on 2026-09-09T13:32:04.400Z and has not been modified since then. This vulnerability affects PocketMine-MP versions before 5.39.2, allowing attackers to exploit a race condition and trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication. Defen [truncated]
CVE-2026-86202 debrief: PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket. The CVE record was published on 2026-09-09T13:32:03.254Z and has not been modified since then. This vulnerability allows clients to trigger consuming animations for all visible players, potentially leading to network amplification and resource waste. Defenders should assess exposure and prioritize upgrading to [truncated]
CVE-2026-86201 is a denial-of-service vulnerability in PocketMine-MP before version 5.41.1. The vulnerability is caused by excessive logging without sanitization in LoginPacket processing, which can lead to out-of-memory conditions and server crashes. Server administrators and security teams should assess their exposure and prioritize updating to version 5.41.1 or later to prevent potential denial-of-serv [truncated]
CVE-2026-86200 is a denial-of-service vulnerability in PocketMine-MP versions before 5.42.1. Remote attackers can flood warning messages by injecting numerous junk properties into the clientData JWT. Server administrators and security teams should assess their exposure and prioritize verifying and updating PocketMine-MP installations to prevent potential denial-of-service attacks. The vulnerability is cau [truncated]
A denial-of-service vulnerability exists in PocketMine-MP versions before 5.25.2, where the explode() function in packet parsing is not limited, allowing malicious clients to waste server resources by sending crafted packets with excessive delimiters. This issue can lead to resource exhaustion and performance degradation if not addressed. Defenders should assess exposure and prioritize updates to mitigate [truncated]
CVE-2025-71417 is a high-severity denial-of-service vulnerability affecting PocketMine-MP versions before 5.32.1. The issue arises from the failure to validate the uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions and exhaust server memory.
A denial of service vulnerability exists in PocketMine-MP before 5.11.1, allowing remote attackers to crash the server by sending malformed JSON data in a LoginPacket, exploiting improper object initialization from scalar JSON types. This issue can lead to server crashes and potential service disruption. Defenders should assess exposure and prioritize updates to version 5.11.1 or later. Monitoring and inv [truncated]
A denial of service vulnerability exists in PocketMine-MP versions before 5.11.2. An attacker can send a crafted BookEditPacket with an inventory slot greater than 35 to trigger an unhandled exception and crash the server. This issue can cause server crashes, leading to service disruption or downtime. Defenders should assess exposure and prioritize updating to version 5.11.2 or later to prevent these issu [truncated]
PocketMine-MP versions before 4.8.1 are vulnerable to a server crash via invalid dye color IDs in banner NBT data. This issue allows attackers to trigger undefined offset errors during deserialization, impacting server availability. Server administrators and developers should assess their exposure and update to version 4.8.1 or later to prevent server crashes. The CVE record was published on 2026-09-09T13 [truncated]
CVE-2023-54395 is a denial-of-service vulnerability in PocketMine-MP before version 4.12.5. The vulnerability allows attackers to cause server resource exhaustion by sending large JSON payloads in ModalFormResponsePacket. This issue affects PocketMine-MP versions before 4.12.5. Defenders should assess exposure and prioritize updates to mitigate this vulnerability. The CVE record and source item provide in [truncated]
PocketMine-MP before 4.18.0-ALPHA2 is vulnerable to a bandwidth amplification attack due to a failure in rate-limiting mismatch type InventoryTransactionPacket requests. This allows attackers to trigger excessive inventory synchronization, consuming significant bandwidth without authentication. Server administrators and security teams should assess exposure and apply the patch to prevent potential attacks [truncated]
CVE-2023-54393 is a denial of service vulnerability in PocketMine-MP versions before 4.20.5. The vulnerability is caused by improper validation in the JsonMapper dependency when parsing LoginPacket JSON. An attacker can send a malformed JSON structure in LoginPacket to crash the server. The CVSS score for this vulnerability is 8.7, indicating a high severity.
A vulnerability in PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) allows a player to crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process. This issue arises from inadequate validation of NBT tag types in BlockActorDataPacket, which can be exploited [truncated]
A denial of service vulnerability exists in PocketMine-MP versions before 5.3.1 and 4.23.1 due to improper null value handling in LoginPacket JSON parsing. An attacker can send a malformed JSON with unexpected null elements in LoginPacket to crash the server. This issue affects server stability and availability, emphasizing the need for prompt updates and verification of server versions. Defenders should [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-09T13:31:50.013Z and has not been modified since then. The vulnerability affects PocketMine-MP versions before 5.3.1 and 4.23.1. It is related to the failure of validating the identityPublicKey in LoginPacket, which allows attackers to provide LoginPackets with keys using different curves or non-EC [truncated]
A vulnerability in PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 allows a player with writable book access to create oversized NBT 'book bombs', potentially causing server crashes and excess bandwidth consumption. This issue arises from the lack of limits on book page text length, page count, or author/title length, enabling malicious players to exploit this vulnerability. Server administrators and d [truncated]
CVE-2022-51017 debrief: PocketMine-MP skin data validation flaw can cause server crashes due to inadequate validation of player-submitted skin data fields, allowing oversized values to exceed the 32767 byte TAG_String limit and trigger exceptions during NBT data serialization. Defenders should assess exposure and prioritize updates to prevent potential server crashes caused by malformed skin data submissi [truncated]
CVE-2022-51016 is a vulnerability in PocketMine-MP 3.x before 3.27.0 that allows for impersonation via login replay attacks due to the lack of Minecraft Bedrock protocol encryption. This vulnerability affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. The CVE record was published on 2026-09-07T13:17:23.607Z and has not been modified since then. Defend [truncated]
A remote authenticated attacker can send crafted packets with invalid facing values to crash the PocketMine-MP server before version 4.0.6, resulting in a denial of service. This issue arises from the server's failure to validate facing values in PlayerActionPacket or UseItemTransactionData, allowing an attacker to exploit this weakness. Defenders should assess exposure and prioritize verification and rem [truncated]
CVE-2022-51014 is a high-severity vulnerability in PocketMine-MP before version 4.0.7. The vulnerability is caused by an unhandled exception in the ModalFormResponsePacket handler when processing malformed JSON from clients. This can lead to server crashes. The CVE record was published on 2026-09-07T13:17:23.317Z and has not been modified since then. The NVD entry is currently Received.
CVE-2022-51013 is a vulnerability in PocketMine-MP versions before 4.2.3. The vulnerability class is related to the failure to validate damage metadata values in tool and armor item NBT data received from clients. This can cause server crashes due to unhandled exceptions in the Durable class. Server administrators and security teams should assess exposure and prioritize updating to version 4.2.3 or later. [truncated]
PocketMine-MP server administrators should assess exposure to denial-of-service attacks via crafted inventory transactions. The CVE record was published on 2026-09-07T13:17:23.030Z and has not been modified since then. Administrators should review their current configurations and consider upgrading to PocketMine-MP version 4.2.9 or later. Additionally, they should verify their inventory transaction handli [truncated]
CVE-2022-51011 debrief based on the supplied source corpus. The vulnerability affects PocketMine-MP installations, particularly those exposed to untrusted clients, and can cause server lockups and increased resource utilization due to large chat messages. Defenders should assess and mitigate this vulnerability to prevent potential operational impacts. The CVE record and NVD entry provide details on the vu [truncated]
CVE-2022-51008 debrief: PocketMine-MP unauthenticated session exhaustion allows attackers to flood servers with connections, occupying max-player slots and preventing legitimate players from joining. Defenders should verify vulnerability details, assess exposure, and prioritize updating to 4.12.3 or later. This includes reviewing server configurations, monitoring player slots, and implementing rate limiti [truncated]