CVE-2026-86199: PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.43.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated player able to reach a vulnerable PocketMine-MP server can trigger the crash during offline login authentication. No credentials or user interaction are required.
Which deployments are affected?
PocketMine-MP versions before 5.43.1 are affected when offline login authentication is used. The provided information does not establish whether configurations not using offline login authentication are affected.
What is the impact of successful exploitation?
A malicious login request can cause an uninitialized property access error that crashes the server, resulting in denial of service. The supplied information indicates no confidentiality or integrity impact.
How can I remediate the issue?
Upgrade PocketMine-MP to version 5.43.1 or later. The provided data does not identify a workaround for systems that cannot be upgraded immediately.