CVE-2026-86201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86201
Aliases
Published
2026-09-09T13:32:02Z
Modified
2026-09-11T03:48:41Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
Details

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86201.json"
}
References

Affected packages

Git / github.com/pmmp/pocketmine-mp

Affected ranges

Type
GIT
Repo
https://github.com/pmmp/pocketmine-mp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ddb447b5cea1ba139b520fe05b570b3ee590d575
Fixed
87d1c0cea09d972fd4c2fafb84dac2ecab7649f0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.41.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4
1.4-916
1.4.1
1.4.1dev-936
1.6.1dev-87
1.6.2dev-229
1.6dev
1.7dev-501
1.7dev-677
1.7dev-83
1.7dev-937
3.*
3.0.0
3.0.1
3.0.2
3.10.0
3.10.1
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.13.0
3.13.1
3.14.0
3.14.1
3.14.2
3.14.3
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.17.5
3.17.6
3.17.7
3.18.0
3.18.1
3.18.2
3.19.0
3.19.1
3.19.2
3.19.3
3.2.0
3.20.0
3.21.0
3.21.1
3.22.0
3.22.1
3.22.2
3.22.3
3.22.4
3.22.5
3.23.0
3.23.1
3.24.0
3.25.0
3.25.1
3.25.2
3.25.3
3.25.4
3.25.5
3.25.6
3.26.0
3.26.1
3.4.0
3.4.1
3.5.0
3.5.1
3.5.10
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
4.*
4.0.0
4.1.0-BETA1
4.1.0-BETA2
4.10.0
4.10.1
4.10.2
4.12.0
4.12.1
4.12.10
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.12.8
4.12.9
4.13.0
4.14.0
4.14.1
4.15.0
4.15.1
4.15.2
4.15.3
4.16.0
4.18.0
4.18.0-ALPHA1
4.18.0-ALPHA2
4.19.0
4.19.1
4.19.2
4.19.3
4.20.0
4.20.1
4.20.2
4.20.3
4.20.4
4.21.0
4.21.1
4.4.0
4.4.0-BETA1
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.1
4.9.0
4.9.1
5.*
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.1.3
5.10.0
5.11.0
5.11.1
5.11.2
5.12.0
5.12.1
5.13.0
5.14.0
5.14.1
5.15.0
5.16.0
5.2.0
5.2.1
5.20.0
5.20.1
5.21.0
5.21.1
5.21.2
5.22.0
5.23.0
5.23.1
5.23.2
5.23.3
5.24.0
5.25.0
5.25.1
5.25.2
5.26.0
5.27.0
5.27.1
5.28.0
5.28.1
5.28.2
5.29.0
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.30.0
5.30.1
5.31.0
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.34.1
5.35.0
5.35.1
5.36.0
5.37.0
5.37.1
5.37.2
5.37.3
5.38.0
5.39.0
5.39.1
5.39.2
5.39.3
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.40.0
5.41.0
5.5.0
5.6.0
5.6.1
5.7.0
5.7.1
5.8.1
5.8.2
5.9.0
Alpha_1.*
Alpha_1.0
Alpha_1.0.1
Alpha_1.0.2
Alpha_1.0.3
Alpha_1.0.4
Alpha_1.0.5
Alpha_1.0.6
Alpha_1.0.7
Alpha_1.0.8
Alpha_1.1
Alpha_1.1.1
Alpha_1.2
Alpha_1.2.1
Alpha_1.3
Alpha_1.3.1
Alpha_1.3.10
Alpha_1.3.2
Alpha_1.3.3
Alpha_1.3.4
Alpha_1.3.5
Alpha_1.3.7
Alpha_1.3.8
Alpha_1.3.9
Alpha_1.4dev-228
Alpha_1.4dev-277
Alpha_1.4dev-413
Alpha_1.4dev-449
Alpha_1.4dev-478
Alpha_1.4dev-491
Alpha_1.4dev-576
Alpha_1.4dev-599
Alpha_1.4dev-659
Alpha_1.4dev-665
Alpha_1.4dev-707
Alpha_1.4dev-834
Alpha_1.4dev-842
Alpha_1.4dev-847
Alpha_1.4dev-855
Alpha_1.4dev-900
api/1.*
api/1.11.0
api/2.*
api/2.0.0
api/2.1.0
api/3.*
api/3.0.0-ALPHA1
api/3.0.0-ALPHA10
api/3.0.0-ALPHA11
api/3.0.0-ALPHA12
api/3.0.0-ALPHA2
api/3.0.0-ALPHA3
api/3.0.0-ALPHA4
api/3.0.0-ALPHA6
api/3.0.0-ALPHA8
Other
pocketmine-mp-rebrand

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86201.json"