CVE-2026-86199: PocketMine-MP DOS Vulnerability

CVE-2026-86199 Overview

CVE-2026-86199 is a denial-of-service vulnerability in PocketMine-MP, a server software implementation for Minecraft: Bedrock Edition. Versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. An unauthenticated remote attacker can send a crafted login packet that triggers an uninitialized property access error, crashing the server process. The flaw is classified as [CWE-184: Incomplete List of Disallowed Inputs] and requires no privileges or user interaction. Because the crash occurs during the pre-authentication login flow, any network-reachable PocketMine-MP instance is exposed until it is upgraded to version 5.43.1.

Critical Impact
Any unauthenticated attacker with network reach to a PocketMine-MP server can repeatedly crash the server process, producing a sustained denial of service for all connected players.

Affected Products

PocketMine-MP versions prior to 5.43.1
Deployments using pocketmine/bedrock-protocol~57.0.0+bedrock-1.26.20
Self-signed authentication path in src/network/mcpe/auth/

Discovery Timeline

2026-09-09 - CVE-2026-86199 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86199

Vulnerability Analysis

PocketMine-MP handles Bedrock Edition login packets through an authentication pipeline that processes JSON Web Token (JWT) chains supplied by the connecting client. During offline (self-signed) login, the server parses a Certificate field embedded in the login payload and initializes internal properties based on its contents.

Before version 5.43.1, the parser did not verify that the Certificate field was present and well-formed before subsequent code paths accessed derived properties. When a client submits a login without a valid Certificate, the server reaches code that reads a property that was never assigned. PHP raises an uninitialized property access error, which propagates up and terminates the server process. The result is a repeatable crash reachable by any unauthenticated peer.

Root Cause

The root cause is missing input validation on the Certificate field within the self-signed login task. The authentication code assumes the field is populated after parsing, but no guard rejects malformed or absent values. The fix relocates and hardens self-signed login handling in ProcessSelfSignedLoginTask.php and bumps pocketmine/bedrock-protocol to ~57.1.0+bedrock-1.26.20 to pull in stricter protocol-level validation.

Attack Vector

Exploitation is network-based, unauthenticated, and requires no user interaction. An attacker connects to the server's Bedrock port (UDP 19132 by default) and submits a crafted Login packet whose JWT chain omits or malforms the Certificate field. The server enters the offline authentication path, dereferences the uninitialized property, and terminates. Repeating the request keeps the server permanently offline.

php

// Patch excerpt: new file src/network/mcpe/auth/ProcessSelfSignedLoginTask.php
<?php
declare(strict_types=1);

namespace pocketmine\network\mcpe\auth;

use pocketmine\lang\Translatable;
use pocketmine\scheduler\AsyncTask;
use pocketmine\thread\NonThreadSafeValue;
use function base64_decode;
// Self-signed login is now handled in a dedicated task that
// validates the Certificate field before any property is accessed.

Source: PocketMine-MP commit 8c75a1d

text

// composer.json bump forcing the fixed bedrock-protocol library
-      "pocketmine/bedrock-protocol": "~57.0.0+bedrock-1.26.20",
+      "pocketmine/bedrock-protocol": "~57.1.0+bedrock-1.26.20",

Source: PocketMine-MP commit e4aaef4

Detection Methods for CVE-2026-86199

Indicators of Compromise

Server process crashes shortly after receiving a Bedrock Login packet from an unfamiliar source address.
PHP fatal error entries in server logs referencing uninitialized property access within the pocketmine\network\mcpe\auth namespace.
Repeated short-lived UDP sessions to port 19132 from the same source without a completed login handshake.

Detection Strategies

Correlate PocketMine-MP process restarts with inbound login attempts to identify crash-loop patterns tied to malformed authentication traffic.
Alert on stack traces that reference ProcessLoginTask or self-signed authentication code paths in the server log stream.
Track the running version of PocketMine-MP across hosts and flag any instance still below 5.43.1.

Monitoring Recommendations

Forward PocketMine-MP server.log and crashdump files to a centralized log store for pattern analysis.
Monitor availability of the Bedrock UDP listener and alert on unplanned service restarts.
Baseline normal login-packet volume per source address and flag bursts consistent with crash-and-reconnect probing.

How to Mitigate CVE-2026-86199

Immediate Actions Required

Upgrade PocketMine-MP to version 5.43.1 or later on every server instance.
Restart the server process after upgrading to ensure the patched authentication task is loaded.
Review recent crashdumps for evidence of pre-patch exploitation attempts and preserve them for triage.

Patch Information

The fix is delivered in PocketMine-MP 5.43.1 and is described in GitHub Security Advisory GHSA-g2fj-p69p-9chp. The relevant code changes are in commit 8c75a1d, which introduces ProcessSelfSignedLoginTask.php, and commit e4aaef4, which upgrades pocketmine/bedrock-protocol to ~57.1.0+bedrock-1.26.20. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict inbound UDP traffic to the Bedrock port so that only trusted source ranges can reach the server until the upgrade is completed.
Require online-mode (Xbox Live) authentication where possible to reduce reliance on the vulnerable self-signed login path.
Place the server behind a proxy or allow-list gateway that rate-limits new login attempts per source address.

bash

# Upgrade PocketMine-MP using the official installer
./start.sh --version 5.43.1

# Or with Composer for source installs
composer require pocketmine/pocketmine-mp:^5.43.1
composer update pocketmine/bedrock-protocol

# Verify the running version
php -r "echo file_get_contents('src/VersionInfo.php');" | grep BASE_VERSION