CVE-2026-86204: PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 5.39.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated player can exploit it. The attack does not require user interaction and can be performed over the network.
What is the operational impact of exploitation?
A malicious player can send ModalFormResponsePacket data containing massive JSON arrays, consuming server memory and CPU. This can make the PocketMine-MP server unresponsive.
Which deployments are affected?
PocketMine-MP versions before 5.39.2 are affected. The provided information does not identify any configuration prerequisite beyond processing ModalFormResponsePacket data.
What should be prioritized for remediation?
Upgrade PocketMine-MP to version 5.39.2 or later. The issue is caused by missing JSON payload-size limits during ModalFormResponsePacket handling.