PocketMine-MP CVE-2026-86198

The attacker must be a connected Minecraft: Bedrock client that has advanced to the resource pack handler phase of the protocol handshake (PR:L per CVSS 4.0). The server must be running PocketMine-MP versions prior to 5.44.2 with no patch applied. No non-default server configuration is required - the vulnerability exists in the standard resource pack negotiation flow present in all default deployments. Exploitation is inherently bounded by the requirement to establish a valid enough session to reach the resource pack phase before the attack packets can be delivered. Meaningful server-wide availability impact further requires coordinating multiple simultaneous malicious connections, since the per-client amplification is limited (VA:L).

The CVSS 4.0 base score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N with VA:L/VI:L and no confidentiality impact) accurately characterises the constrained real-world risk. The AT:P modifier reflects that the attacker must first reach the resource pack handler state within an established session, which functions as a meaningful precondition. PR:L confirms that exploitation requires an authenticated or at minimum a partially connected client - anonymous internet scanning is not a viable trigger. No CISA KEV listing is present, and no EPSS score was provided in the input data. A publicly available proof-of-concept exists via the GitHub advisory, raising the threat slightly above theoretical. Effective server degradation at scale would require coordinating many simultaneous malicious clients, which limits opportunistic exploitation. The 'Information Disclosure' tag attached to this CVE is a clear mislabeling - the actual impact is resource amplification in the DoS category, with no data leakage whatsoever. Overall, this is a real but low-priority finding for most operators, though gaming-server communities that run public PocketMine-MP instances with open registration may face more exposure.

A malicious Minecraft: Bedrock client establishes a connection to a vulnerable PocketMine-MP server and enters the resource pack negotiation phase. Instead of completing the sequence legitimately, the client floods the server with STATUS_COMPLETED ResourcePackClientResponsePacket messages in rapid succession. Each packet causes the server to re-execute pre-spawn progression, spawning additional duplicate Player objects and expanding heap memory and network buffers - degrading performance for all concurrently connected legitimate players. A publicly available proof-of-concept is documented in GitHub security advisory GHSA-pg53-p7qp-65cv.