{"action":"Upgrade pocketmine/pocketmine-mp to 5.42.1 or later.","affected":[{"fixed":"5.42.1","introduced":"0"}],"component":"pocketmine/pocketmine-mp","cve_ids":["CVE-2026-86200"],"ecosystem":"Packagist","epss":0.00637,"exploited":false,"fixed_versions":["5.42.1"],"ghsa_id":"GHSA-xp4f-g2cm-rhg7","id":"tcs_01M5KFB71VW26A6Q6Y2AGSDWHS","modified_at":"2026-09-10T03:56:07.032429357Z","published_at":"2026-04-15T19:43:33Z","references":["https://osv.dev/vulnerability/GHSA-xp4f-g2cm-rhg7","https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7","https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71","https://github.com/pmmp/PocketMine-MP","https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L289-L303","https://github.com/pmmp/PocketMine-MP/blob/5.41.1/src/network/mcpe/handler/LoginPacketHandler.php#L334-L350"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-xp4f-g2cm-rhg7","url":"https://osv.dev/vulnerability/GHSA-xp4f-g2cm-rhg7"},{"source":"nvd","source_id":"CVE-2026-86200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86200"}],"summary":"PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket"}