Every CVE Search/ Get API key

CVE-2026-86198

PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

2.3 LowFix available

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.38%Up 0.1 points since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.3

PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Record
CVE-2026-86198
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-837
Updated
2026-11-02
EUVDEUVD-2026-74909 2.3

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Record
EUVD-2026-74909
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hp34-98g7-38jv 2.3

PocketMine-MP versions before 5.44.2 fail to properly validate multiple...

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Record
GHSA-hp34-98g7-38jv
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-837
Updated
2026-11-02
GitHub AdvisoriesGHSA-pg53-p7qp-65cv 2.3

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Summary

During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.

Impact

Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.

Workarounds

Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.

Patches

This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

Record
GHSA-pg53-p7qp-65cv
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-837
Updated
2026-11-02
NVD 2.3

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Record
CVE-2026-86198
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-837
Updated
2026-11-02
OSV 2.3

PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Record
CVE-2026-86198
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-837
Updated
2026-11-02
OSVGHSA-pg53-p7qp-65cv 2.3

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Summary

During the resource pack stage of logging in, after the server sends ResourcePackStackPacket, a malicious client can send a batch of multiple ResourcePackClientResponsePacket packets with status ResourcePackClientResponsePacket::STATUS_COMPLETED causing the server to repeatedly execute pre-spawn progression.

Impact

Multiple Player objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large pre-spawn packets such as AvailableCommandsPacket and CreativeContentPacket.

Workarounds

Plugins can use their own PacketHandler classes that reject/ignore any extra ResourcePackClientResponsePacket packets.

Patches

This issue was patched in https://github.com/pmmp/PocketMine-MP/commit/7a27894146a04964ab628ed9033140fdbf887ff3 and released in 5.44.2.

Record
GHSA-pg53-p7qp-65cv
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-837
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pocketmine/pocketmine-mp
Packagist
 before 5.44.2
5.44.2
pocketmine/pocketmine-mp
Packagist
 before 5.44.2, plus listed versions
3.0.03.0.13.0.103.0.113.0.12
Show 45 moreShow less
3.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.23.1.33.1.43.1.53.1.63.1.73.1.83.10.03.10.13.11.03.11.13.11.23.11.33.11.43.11.53.11.63.11.73.12.03.12.13.12.23.12.33.12.43.12.53.12.63.13.03.13.13.14.03.14.13.14.23.14.33.15.03.15.13.15.23.15.33.15.4
5.44.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-86198 is a low vulnerability (CVSS 2.3) in Pmmp Pocketmine-mp, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in pocketmine/pocketmine-mp 5.44.2.

References

This page doesn't list everything

Left out here: 338 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open