What is the CVSS score of CVE-2026-86201?

CVE-2026-86201 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-86201?

Yes, a public proof-of-concept exploit is available for CVE-2026-86201. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-86201?

Within 24 hours, inventory all PocketMine-MP deployments and identify which instances are internet-accessible or reachable from untrusted networks; escalate production instances for expedited remediation. Within 7 days, upgrade all affected instances to PocketMine-MP version 5.41.1 or later and verify the upgrade through a test login to confirm the patch is active. Within 30 days, audit network access controls to restrict the Bedrock port (default 19132) to required sources only, enable server-side logging to capture login anomalies, and confirm all instances remain on 5.41.1 or later through automated inventory scanning.

PocketMine-MP CVE-2026-86201

Q: Which versions of PocketMine-MP are affected by CVE-2026-86201?

PocketMine-MP Minecraft Bedrock servers running versions before 5.41.1 are vulnerable to unauthenticated remote denial-of-service attacks that instantly crash the server process, interrupting service…. A patch is available.

EUVD-2026-74912 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-09-09 VulnCheck

GHSA-qrr8-c2f6-fmqr

Denial Of Service Pocketmine Mp Pmmp

8.7

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Connect to server UDP port 19132
Delivery

Send LoginPacket with crafted clientData JWT
Exploit

Embed deeply nested/massive object in unknown property
Execution

Server warnUndefinedJsonPropertyHandler calls var_export() on payload
Persist

PHP process exhausts all memory
Impact

Server process crashes (DoS)

Vulnerability Assessment

Weakness	CWE CWE-400 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource consumption limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions are required - the LoginPacket is processed during the connection-establishment phase before any authentication or session state exists, so unauthenticated actors with network access to the Minecraft Bedrock port (default UDP 19132) can trigger the crash directly. The vulnerability is present in all default PocketMine-MP deployments before 5.41.1 with no configuration toggle required. Exploitation is limited by network reachability: servers behind NAT, firewalls restricting inbound UDP 19132 to known IPs, or LAN-only deployments are not exposed. No Minecraft account credentials, no prior connection state, and no server-side user interaction are needed.
Impact	The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately characterizes the threat: remote, unauthenticated, low-complexity, fully automatable availability destruction. The attack operates at the pre-authentication phase of the login flow, meaning authentication controls provide no protection. A crashed server can be immediately re-crashed upon restart if unpatched, creating a persistent availability outage. The publicly available PoC in GHSA-h6rj-3m53-887h provides working Go client code and a step-by-step reproduction guide, lowering attacker skill requirements to near zero. No CISA KEV listing exists and EPSS data is not available in the provided input, so widespread exploitation is not confirmed but should not be ruled out given the PoC's accessibility. The principal risk limiter is deployment footprint: PocketMine-MP serves the Minecraft Bedrock gaming community rather than enterprise environments, and servers behind firewalls, NATs, or IP allowlists have substantially reduced exposure. Public-facing community servers are the highest-risk tier.
Exploit ScenarioDerived	An attacker runs a custom Minecraft Bedrock client (using the Go snippet published in GHSA-h6rj-3m53-887h) that connects to a public PocketMine-MP server on UDP port 19132 and sends a LoginPacket with a clientData JWT body containing an `invalid_key` property set to a 500-level deeply nested array with millions of integer elements. The server's `warnUndefinedJsonPropertyHandler` immediately invokes `var_export()` on this structure, consuming all PHP process memory within milliseconds and crashing the server before any authentication check is reached. The attack can be repeated instantly on restart, sustaining a complete availability outage.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

2 PoC candidates (unverified) Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's var_export() without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.

RemediationAI

Upgrade to PocketMine-MP 5.41.1 or later (Composer: composer require pocketmine/pocketmine-mp:^5.41.1), which is the vendor-confirmed fix per GHSA-h6rj-3m53-887h and commit 87d1c0c. The patch removes the var_export() call and caps logged property names at 80 characters via Utils::printable(substr($name, 0, 80)), eliminating unbounded memory use. As a plugin-based workaround before patching, intercept LoginPacket via DataPacketReceiveEvent and re-parse the clientData JWT using a JsonMapper with bExceptionOnUndefinedProperty = true - note the vendor explicitly warns this may cause login failures if Microsoft adds new undocumented fields to future Bedrock clients, which has occurred historically. For servers that cannot be immediately upgraded, restrict inbound UDP traffic on port 19132 to trusted source IPs via firewall rules, accepting the trade-off of limiting public accessibility.

Affected VersionsENISA

PocketMine-MP 0 <5.41.1

Affected Packages

composer pocketmine/pocketmine-mp fix: 5.41.1

euvd pocketmine_mp fix: 5.41.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in composer, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

PocketMine-MP is the primary PHP-based Minecraft Bedrock Edition server implementation (CPE: cpe:2.3:a:pmmp:pocketmine-mp:*:*:*:*:*:*:*:*). During the Minecraft handshake, clients send a LoginPacket containing a clientData JWT body parsed by a JsonMapper instance. To accommodate undocumented properties Microsoft may add to future Bedrock client versions, this JsonMapper is intentionally configured in warn mode (bExceptionOnUndefinedProperty = false) rather than reject mode. When an unknown property is encountered, the warnUndefinedJsonPropertyHandler callback in LoginPacketHandler.php emits a log line that includes both the property name (with no length cap) and the serialized value via PHP's var_export($value, return: true). CWE-400 (Uncontrolled Resource Consumption) is the precise root cause: var_export() on a 500-level deeply nested array containing millions of elements forces PHP to recursively traverse and serialize the entire structure in memory before returning, driving the process into an out-of-memory condition and crash. The fix in commit 87d1c0c replaces var_export() with Utils::printable(substr($name, 0, 80)), capping the logged property name and discarding the attacker-controlled value entirely.

Know when Pocketmine Mp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Pre-auth network reachable DoS with no complexity or privileges; only availability impacted, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

Technical POC Analysis

The issue is an uncontrolled resource consumption bug (CWE-400) in src/network/mcpe/handler/LoginPacketHandler.php in PocketMine-MP before 5.41.1.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Latest POC

2 PoC candidates from github (unverified)

Executive ViewAI

Why It Matters

PocketMine-MP Minecraft Bedrock servers running versions before 5.41.1 are vulnerable to unauthenticated remote denial-of-service attacks that instantly crash the server process, interrupting service for all connected players. An attacker with network access to the Bedrock port requires only a single malicious packet and no authentication to trigger complete service unavailability. Organizations operating public or internet-exposed PocketMine-MP instances face immediate operational risk to player availability and service continuity.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 73% exploitable

Prevalence

Low

niche Minecraft Bedrock server, gaming community footprint only

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.