CVE-2026-86198: PocketMine-MP Resource Pack DOS Vulnerability

CVE-2026-86198 is a denial of service vulnerability in PocketMine-MP caused by improper validation of resource pack response packets. Attackers can trigger duplicate Player objects, exhausting server resources. This post covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-86198 Overview

CVE-2026-86198 is a denial of service vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 5.44.2 fail to validate repeated ResourcePackClientResponsePacket packets carrying STATUS_COMPLETED. A malicious authenticated client can flood the server with these packets to repeatedly trigger pre-spawn progression. Each iteration creates a duplicate Player object, amplifying memory consumption and outbound network traffic. The flaw maps to [CWE-837: Improper Enforcement of a Single, Unique Action].

Critical Impact
Authenticated clients can exhaust server memory and network bandwidth by sending batches of resource pack completion packets, degrading availability for legitimate players.

Affected Products

PocketMine-MP versions prior to 5.44.2
Minecraft: Bedrock Edition server deployments running vulnerable PocketMine-MP builds
Any hosting environment exposing PocketMine-MP to untrusted clients

Discovery Timeline

2026-09-09 - CVE-2026-86198 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86198

Vulnerability Analysis

The defect lives in src/network/mcpe/handler/ResourcePacksPacketHandler.php. During the resource pack negotiation phase, the handler processes ResourcePackClientResponsePacket messages and, upon receiving STATUS_COMPLETED, invokes a completion callback that advances the session into pre-spawn logic. The handler does not deregister itself after firing this callback. Subsequent completion packets are still routed to the same handler instance, allowing the pre-spawn transition to execute repeatedly for a single session.

Each repeated invocation instantiates a new Player object bound to the same connection. Duplicate objects consume heap memory and generate additional outbound state synchronization traffic, degrading server responsiveness.

Root Cause

The root cause is missing single-action enforcement [CWE-837]. The completion path lacks a state check to ensure STATUS_COMPLETED is honored only once per session. Without unbinding the handler after the first completion, the server treats every subsequent packet as a fresh completion event.

Attack Vector

Exploitation requires network access and a low-privilege authenticated session on the target server. The attacker connects with a crafted client and sends a batch of ResourcePackClientResponsePacket packets, each carrying STATUS_COMPLETED, before spawn completes. No user interaction on the server side is required.

php

				break;
 			case ResourcePackClientResponsePacket::STATUS_COMPLETED:
 				$this->session->getLogger()->debug("Resource packs sequence completed");
+				if($this->session->getHandler() === $this){
+					$this->session->setHandler(null);
+				}
 				($this->completionCallback)();
 				break;
 			default:

Source: PocketMine-MP commit 7a27894. The patch clears the active handler on the session before invoking the completion callback, preventing repeat processing of the completion status.

Detection Methods for CVE-2026-86198

Indicators of Compromise

Repeated "Resource packs sequence completed" debug log entries associated with a single session identifier
Sudden growth in the number of Player objects tracked by the server relative to active network connections
Sustained outbound bandwidth spikes from the PocketMine-MP process during the pre-spawn window

Detection Strategies

Instrument the resource pack handler to alert when a session emits more than one STATUS_COMPLETED packet
Monitor PHP process memory (memory_get_usage) and correlate anomalies with new client sessions
Baseline expected join-flow packet counts and flag sessions that exceed the threshold before spawn

Monitoring Recommendations

Forward PocketMine-MP debug and network logs to a centralized log store for correlation across sessions
Track per-IP connection velocity and packet volume to identify clients that abuse the pre-spawn phase
Alert on repeated increments of the internal player entity count without corresponding new TCP sessions

How to Mitigate CVE-2026-86198

Immediate Actions Required

Upgrade PocketMine-MP to version 5.44.2 or later, which includes the handler fix from commit 7a27894
Restrict server exposure by placing PocketMine-MP behind allowlists or a reverse proxy where feasible
Review current server logs for the indicators listed above to identify prior abuse attempts

Patch Information

The fix is available in PocketMine-MP 5.44.2. See the GitHub Security Advisory GHSA-pg53-p7qp-65cv and the VulnCheck Denial of Service Advisory for full remediation details. The patch, published as PocketMine-MP commit 7a27894, sets the session handler to null after the first STATUS_COMPLETED so subsequent packets are not routed back to the completion path.

Workarounds

If patching is delayed, apply the upstream commit as a local hotfix to ResourcePacksPacketHandler.php
Enforce per-IP rate limiting at the network layer to reduce the volume of packets a single client can send
Terminate long pre-spawn sessions that exceed expected timing budgets to bound resource usage

bash

# Upgrade PocketMine-MP to the patched release
composer require pocketmine/pocketmine-mp:^5.44.2

# Verify the running version
php PocketMine-MP.phar --version