PocketMine-MP CVE-2026-86200

No authentication, configuration change, or special client state is required: any host that can reach the server's Bedrock network port (default UDP 19132) can send a pre-authentication LoginPacket. The vulnerability is triggered by the default permissive JsonMapper configuration active in all versions before 5.42.1, which was deliberately enabled to accommodate undocumented clientData JWT fields that Microsoft introduces between Bedrock client versions. Exploitation is limited to performance degradation and log flooding; it does not achieve code execution, data disclosure, or a hard crash. Servers not exposed to untrusted networks - such as private LAN-only or allowlist-restricted deployments with firewall rules blocking external access to UDP 19132 - are not practically at risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) scores 6.9, reflecting no authentication requirement and no confidentiality or integrity impact, with only low availability degradation. Real-world risk is moderate but practically relevant for operators of public Bedrock servers: the attack is trivially automatable since it requires only the ability to reach the game port and send a login-phase packet before any session authentication occurs. The publicly available proof-of-concept in GHSA-xp4f-g2cm-rhg7 further lowers the skill threshold for exploitation. EPSS data is absent from the available intelligence and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread exploitation campaign. The impact is bounded - servers continue running, and the effect is performance degradation and log flooding rather than crash or persistent outage - so even a mid-sized Minecraft network operator in gliwice managing several public Bedrock server instances should treat patching as important but not emergency-priority, particularly since the 5.42.1 fix is targeted and straightforward to deploy.

An unauthenticated remote attacker crafts a Bedrock Edition LoginPacket whose clientData JWT contains hundreds or thousands of fabricated JSON property names alongside the legitimate fields and transmits it to the server's Bedrock UDP port before any session is established. For each unexpected property, PocketMine-MP writes a formatted warning log entry and performs reflection to obtain the class name, driving sustained CPU and I/O load. Repeated delivery of such packets degrades server responsiveness for legitimate players; a public proof-of-concept on GitHub confirms the attack is straightforward to reproduce.