CVE-2026-86199 in PocketMine-MP
Summary
by MITRE • 09/09/2026
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in PocketMine-MP prior to version 5.43.1 represents a critical failure in input validation within the offline mode authentication subsystem. Offline servers, which do not connect to Mojang's authentication services for player verification, rely on local logic to validate incoming connection requests and user identities. In this specific implementation, the server fails to properly sanitize or verify the Certificate field included during the login handshake process. This oversight allows unauthenticated actors to inject malformed data that bypasses expected validation routines, leading directly to a denial of service condition rather than an authentication bypass. The core technical flaw lies in the handling of uninitialized properties within the PHP runtime environment when processing these specific certificate structures.
From a technical perspective, this issue is classified under CWE-457, which describes the use of an uninitialized variable or property. When an unauthenticated player sends a crafted login packet containing a malformed Certificate field, the server-side script attempts to access a property that has not been initialized due to the unexpected data structure. In PHP environments running PocketMine-MP, this typically results in a fatal error or an exception being thrown by the runtime engine because it cannot resolve the reference to undefined state variables. This abrupt termination of the execution thread causes the entire server process to crash, rendering the game instance unavailable for legitimate users until the service is manually restarted.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without any form of authentication. An attacker can trigger a denial of service against PocketMine-MP servers operating in offline mode simply by sending a single crafted network packet during the initial connection phase. This capability allows malicious actors to disrupt gameplay, cause downtime for communities relying on these private servers, and potentially exhaust server resources if repeated attempts are made rapidly. Since no prior authentication is required, the attack surface is maximized, as any IP address capable of reaching the server port can attempt this exploit.
This vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques related to application exhaustion or resource consumption through crash-inducing inputs. It also reflects weaknesses associated with CWE-20, Improper Input Validation, as the system failed to restrict or validate the structure and content of incoming data before processing it within critical authentication logic paths. The lack of robust error handling for malformed certificate structures indicates a gap in defensive programming practices regarding network protocol implementation.
Mitigation strategies primarily involve upgrading the PocketMine-MP software to version 5.43.1 or later, where this validation flaw has been addressed by developers through stricter type checking and initialization protocols for authentication fields. For administrators unable to upgrade immediately due to plugin compatibility constraints, implementing a reverse proxy such as Nginx or HAProxy in front of the Minecraft server can provide temporary relief. These proxies can be configured with rate-limiting rules or custom filtering modules that inspect incoming packets during the handshake phase and drop connections exhibiting patterns consistent with this exploit before they reach the vulnerable application layer. Additionally, restricting access to known IP ranges via firewall rules reduces the attack surface by limiting exposure to untrusted networks.