Packagist/pocketmine/pocketmine-mp CVE-2026-86200: medium 5.3, EPSS 0.64%
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
Action: Upgrade pocketmine/pocketmine-mp to 5.42.1 or later.
composer require pocketmine/pocketmine-mp:5.42.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.42.1 | - |
Fixed versions
| 5.42.1 |
Sources
- osv: GHSA-xp4f-g2cm-rhg7
- nvd: CVE-2026-86200
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7
- https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71
- https://github.com/pmmp/PocketMine-MP
- https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L289-L303
- https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L334-L350
CVE-2026-86200 · published · modified · JSON