CVE-2026-86204 PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
Authenticated players can crash PocketMine-MP servers by sending oversized JSON payloads in modal form responses, exhausting resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86204?
CVE-2026-86204 is a high-severity denial of service vulnerability in pmmp PocketMine-MP, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Weakness: CWE-400
Which versions are affected by CVE-2026-86204?
2 open source packages ship an affected version, including pocketmine/pocketmine-mp.
| Package | Affected | Fixed in |
|---|---|---|
pocketmine/pocketmine-mp Packagist | All versions | 5.39.2 |
pocketmine/pocketmine-mp Packagist | All versions | 5.39.2 |
How do I fix CVE-2026-86204?
Upgrade pocketmine/pocketmine-mp to 5.39.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-86204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86204 exists.
Sources
Also known as GHSA-323m-6rhr-p53j, GHSA-788v-5pfp-93ff.