{"action":"Upgrade pocketmine/pocketmine-mp to 5.39.2 or later.","affected":[{"fixed":"5.39.2","introduced":"0"}],"component":"pocketmine/pocketmine-mp","cve_ids":["CVE-2026-86204"],"ecosystem":"Packagist","epss":0.00436,"exploited":false,"fixed_versions":["5.39.2"],"ghsa_id":"GHSA-788v-5pfp-93ff","id":"tcs_01M5KEXTX7DR1V47GA1RMDT0ZK","modified_at":"2026-09-10T03:56:07.977779804Z","published_at":"2026-04-06T22:54:07Z","references":["https://osv.dev/vulnerability/GHSA-788v-5pfp-93ff","https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff","https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877","https://github.com/pmmp/PocketMine-MP/commit/f983f4f66d5e72d7a07109c8175799ab0ee771d5","https://github.com/pmmp/PocketMine-MP"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-788v-5pfp-93ff","url":"https://osv.dev/vulnerability/GHSA-788v-5pfp-93ff"}],"summary":"PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling"}