PocketMine-MP CVE-2026-86204

The attacker must hold a fully established player session on the target server - specifically, the player must have completed the spawn sequence and entered the game world, as ModalFormResponsePacket handling is skipped for players who have not yet spawned. Standard player authentication (Bedrock Edition account, or offline-mode join depending on server configuration) is required, but no operator, admin, or special in-game permissions are needed beyond basic player status. The vulnerability affects all PocketMine-MP versions before 5.39.2 regardless of world type, plugin configuration, or game mode. On whitelist-enforced servers, anonymous internet attackers are blocked, but any whitelisted player - including regular users - can trigger the condition. Network access to the server's UDP game port (default 19132) is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 7.1) appropriately reflects that a low-privileged network attacker - any authenticated player - can achieve high availability impact with minimal complexity. Impact is strictly availability: confidentiality and integrity are unaffected. A public PoC with functional Node.js code exists in the vendor advisory, substantially lowering the bar for exploitation; no CISA KEV listing is present, so widespread active exploitation is not confirmed. Even a small gaming infrastructure operator running public PocketMine-MP servers should treat this as urgent given the trivial exploitation path: a single malicious player can take down the entire server for all connected users. EPSS data was not provided in the input and cannot be assessed. The primary limiting factor is the authentication requirement - the attacker must hold an established in-game session - which provides a minor barrier on whitelist-enforced servers but no meaningful protection on open-access public servers.

An attacker joins a public PocketMine-MP server using a standard Bedrock Edition account and waits until their character spawns into the game world. Using the publicly available Node.js PoC (based on the bedrock-protocol library) from the GHSA advisory, the attacker sends a ModalFormResponsePacket with a nonexistent formId and a formData field containing a JSON array of five million elements (approximately 10+ MB). The server's PHP JSON decoder begins allocating memory proportional to the payload, consuming all available RAM and CPU and causing the server to freeze, disconnecting every other connected player.