CVE-2026-86203 in PocketMine-MP
Summary
by MITRE • 09/09/2026
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in PocketMine-MP versions prior to 5.39.2 represents a critical integrity failure within the server-side entity management logic, specifically concerning the handling of client-initiated attack packets during player disconnection sequences. This flaw stems from an insufficient validation mechanism for the despawn state of entities involved in combat interactions. When a player initiates a disconnect sequence while simultaneously engaging another entity or player in combat, the server fails to properly synchronize the termination of the connection with the finalization of the combat event loop. Instead of treating the disconnection as an immediate and absolute cessation of all associated game logic for that specific client session, the system allows pending attack packets to be processed even after the disconnect signal has been received but before the entity is fully removed from the active world state. This creates a temporal window where the server perceives the attacking action as valid despite the attacker's session being in a transitional or terminated state, leading to inconsistent application of game rules and state management errors.
From a technical perspective, this issue manifests as a race condition within the packet processing pipeline. The core defect lies in the lack of atomicity when handling the intersection of network disconnection events and combat event handlers. When an attack packet is received from a client that has already signaled its intent to disconnect or whose connection state has been marked for closure, the server does not immediately invalidate subsequent packets belonging to that session before executing the associated damage and death logic. Consequently, if multiple such packets are processed in rapid succession during this narrow window, the game engine triggers the death handler routine more than once for a single logical event. This duplication of execution is particularly dangerous because it bypasses standard safeguards designed to prevent state corruption or resource exploitation through repeated triggering of end-of-life routines for entities.
The operational impact of this vulnerability is primarily centered around economic and inventory integrity within multiplayer environments, specifically facilitating item and experience point duplication. When the death handler is triggered multiple times due to the race condition, each invocation results in the spawning of dropped items corresponding to the victim's inventory contents and accumulated experience orbs. Since these drops are generated independently for each trigger instance rather than being deduplicated or checked against existing drop entities on the ground, players can effectively duplicate valuable resources by exploiting this flaw during disconnection events. This not only disrupts game balance but also undermines trust in server economies, as items that should be permanently lost upon death reappear multiple times, allowing attackers to accumulate wealth and experience at an accelerated rate without corresponding gameplay effort or risk.
This vulnerability aligns with CWE-362, which describes concurrent execution using shared resources with insufficient synchronization, specifically highlighting the race condition aspect where two processes (the disconnect handler and the attack packet processor) access shared state (entity despawn status) concurrently without proper locking or validation. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior can be categorized under T1059 Command Scripting or more broadly as exploitation of logic flaws for resource manipulation, although it is most accurately described as an abuse of game mechanics through state inconsistency rather than traditional command injection. The attack vector relies on the attacker controlling their own client actions to trigger specific timing conditions against a target player who is disconnecting, making it a localized but potent exploit that requires precise execution during network latency spikes or intentional disconnection attempts.
Mitigation strategies must focus on enforcing strict validation of entity states before processing any combat-related packets from clients in transitional connection states. The primary fix involves ensuring that once a disconnect signal is received for a specific client session, all pending and subsequent attack packets associated with that session are immediately discarded or ignored by the server's event loop. Additionally, implementing idempotency checks within the death handler logic can prevent duplicate processing of the same entity demise event regardless of how many times it is triggered in quick succession. Server administrators should prioritize updating to version 5.39.2 or later where these validation mechanisms have been corrected. In environments where immediate patching is not feasible, implementing custom plugins that monitor for rapid-fire attack packets from disconnecting clients and suppressing their effects can serve as a temporary workaround to preserve inventory integrity until the official update is applied.