Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

Medium 4.2

In plain English

A medium-severity security flaw in PocketMine-MP from pmmp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pocketmine/pocketmine-mp	5.44.2	GHSA-pg53-p7qp-65cv

Affected products (as reported)

Vendor	Product	Versions
pmmp	PocketMine-MP	0 – before 5.44.2

Weakness: CWE-837 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-pg53-p7qp-65cv) vendor-advisory
Patch Commit patch
VulnCheck Advisory: PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket third-party-advisory