CVE-2026-86201: PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PocketMine-MP versions before 5.41.1 are affected. A network-reachable server is exposed because exploitation uses crafted LoginPackets.
Does exploitation require authentication or user interaction?
No. The provided severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the practical impact of a successful attack?
An attacker can cause excessive logging by placing deeply nested or very large object structures in unknown clientData JWT properties. This can exhaust memory and crash the server, affecting availability.
What should be done if the server cannot be upgraded immediately?
The provided data identifies upgrading to 5.41.1 or later as the version boundary that addresses the issue. It does not provide a confirmed temporary mitigation.