CVE-2026-86200

MEDIUM 5.3

PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

CWE	CWE-779
Vendor	pmmp
Product	pocketmine-mp
Published	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for pmmp pocketmine-mp

Be the first to know when new medium vulnerabilities affecting pmmp pocketmine-mp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

pmmp / PocketMine-MP

0 < 5.42.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7 github.com: https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71 vulncheck.com: https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt

Credits

🔍 iYozemMc dktapps