CVE-2026-86200: PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.42.1 - Compensating control
Mitigate the LoginPacket denial-of-service by limiting remote access/flooding against the PocketMine-MP server (e.g., rate-limit or firewall/ACL protection on the game/login port) until all servers are upgraded to 5.42.1 or later.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PocketMine-MP versions before 5.42.1 are affected. Because exploitation uses malicious login packets, a remotely reachable server can be targeted by an attacker without privileges or user interaction.
What does an attacker need to send to trigger the performance impact?
The attacker must craft a login packet containing a clientData JWT with numerous excessive unknown properties. These properties cause warning-message flooding and consume server CPU time.
What can be done if upgrading is not immediately possible?
The provided information identifies upgrading to PocketMine-MP 5.42.1 or later as the available remediation boundary. No configuration workaround or detection method is specified.