CVE-2026-86201 in PocketMine-MP
Summary
by MITRE • 09/09/2026
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The security flaw identified in PocketMine-MP versions prior to 5.41.1 represents a critical denial of service vulnerability rooted in the improper handling of JSON Web Tokens within the LoginPacket processing mechanism. This issue specifically affects how the server parses unknown properties contained within clientData JWTs sent by connecting clients. The core technical deficiency lies in the absence of input sanitization and structural validation for these custom or unrecognized fields. When a malicious actor constructs a LoginPacket containing deeply nested object structures or excessively large data payloads, the server attempts to process and log this information without imposing size limits or depth restrictions. This lack of constraint allows an attacker to exploit the resource consumption patterns inherent in parsing complex JSON-like structures, leading directly to system instability.
From a technical perspective, the vulnerability exploits the logging subsystem's behavior when encountering malformed or excessively large inputs. Instead of rejecting invalid data early in the authentication handshake, the server proceeds with extensive processing and subsequent logging operations. The recursive nature of nested objects causes exponential growth in memory allocation requirements during parsing. As the depth and complexity of the injected structures increase, the application consumes available heap space rapidly. This uncontrolled resource consumption eventually triggers an out-of-memory condition, causing the Java Virtual Machine or underlying runtime environment to terminate abruptly. Consequently, the Minecraft server becomes unavailable to legitimate users, resulting in a complete service outage until manual intervention is required to restart the process.
The operational impact of this vulnerability is severe for any public-facing PocketMine-MP instance that accepts connections from untrusted sources. An attacker can execute a remote denial of service attack without requiring authentication or prior access privileges. By simply sending crafted packets during the initial login phase, the adversary can crash the server repeatedly, disrupting gameplay and potentially causing data loss if automatic save mechanisms are interrupted mid-operation. This type of attack is particularly dangerous because it requires minimal effort to exploit and does not rely on complex social engineering or privilege escalation techniques. The availability of such a straightforward vector makes PocketMine-MP servers attractive targets for opportunistic attackers seeking to disrupt services or test the resilience of network defenses.
In terms of industry classification, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. It also relates to CWE-20, improper input validation, as the system fails to adequately sanitize and validate incoming data structures before processing them for logging purposes. Within the MITRE ATT&CK framework, this behavior corresponds to T1499, Endpoint Denial of Service, specifically under techniques that involve resource exhaustion through application layer attacks. The attack vector is classified as Network-based with low complexity, allowing remote exploitation over TCP/IP connections typical of Minecraft server communications.
To mitigate this vulnerability, administrators must upgrade PocketMine-MP to version 5.41.1 or later, where the developers have implemented proper sanitization and size limits for JWT properties. Until an update is applied, operators can implement network-level mitigations such as rate limiting on login attempts or using reverse proxies that inspect packet sizes before forwarding them to the game server. Additionally, configuring stricter logging levels that exclude verbose output of large binary data structures during authentication failures can reduce the severity of memory exhaustion events. Regularly monitoring system resource usage and setting up alerts for abnormal spikes in memory consumption can also help detect ongoing exploitation attempts early, allowing for rapid response and containment before a full crash occurs.