CVE-2026-86203: PocketMine-MP before 5.39.2 Item Duplication via Despawn State
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.39.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote client can attempt exploitation, but the attack requires a high-complexity race condition involving attacking a player while that player is disconnecting.
What is the impact of successful exploitation?
Successful exploitation can cause multiple death handlers to run, dropping a player's inventory items and experience multiple times. This enables item and experience duplication.
Which deployments are affected?
PocketMine-MP versions before 5.39.2 are affected. The issue is in processing client attack packets without validating the target entity's despawn state.
What is the remediation?
Upgrade PocketMine-MP to version 5.39.2 or later. The affected behavior is addressed by validating entity despawn state during attack-packet processing.