CVE-2026-86200: PocketMine-MP LoginPacket DoS Vulnerability

CVE-2026-86200 Overview

CVE-2026-86200 is a denial of service vulnerability in PocketMine-MP versions before 5.42.1. The flaw resides in the LoginPacket handler, which logs a warning for every unknown JSON property in the clientData JWT payload. Remote unauthenticated attackers can craft malicious login packets containing large numbers of junk properties. Each property triggers a reflection-based warning log, wasting server CPU and degrading performance for legitimate players. The issue is tracked under CWE-779: Logging of Excessive Data.

Critical Impact
Unauthenticated remote attackers can degrade PocketMine-MP server performance by flooding the log subsystem with warnings generated from malicious LoginPacket payloads.

Affected Products

PocketMine-MP versions prior to 5.42.1
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Plugin ecosystems depending on affected PocketMine-MP releases

Discovery Timeline

2026-09-09 - CVE-2026-86200 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86200

Vulnerability Analysis

PocketMine-MP parses the clientData JWT contained inside a LoginPacket during the Minecraft: Bedrock Edition login handshake. When the parser encounters JSON properties that do not map to a known field on the target object, the handler warnUndefinedJsonPropertyHandler invokes PHP reflection and emits a warning log for each occurrence. No cap exists on the number of warnings generated per packet.

An unauthenticated attacker can submit a single crafted LoginPacket carrying thousands of junk properties. Each property triggers ReflectionClass instantiation, string sanitization via Utils::printable, and a synchronous logger write. The cumulative cost consumes CPU cycles, blocks the network thread, and inflates log storage, resulting in a network-reachable denial of service condition against the game server.

Root Cause

The root cause is unbounded logging in the LoginPacketHandler class. The undefined-property callback treated attacker-controlled input as trusted operational data and produced one warning per unknown key. The absence of a rate limit or maximum-property threshold allowed a single request to amplify into arbitrarily many logger operations.

Attack Vector

Exploitation requires only network access to the PocketMine-MP listener port. The attacker connects, initiates the Bedrock login sequence, and transmits a LoginPacket whose clientData JWT payload contains a large collection of unrecognized JSON properties. No authentication, user interaction, or prior session is required.

php

// Patch: src/network/mcpe/handler/LoginPacketHandler.php
// Source: https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71

private function warnUndefinedJsonPropertyHandler(string $context) : \Closure{
    return function(object $object, string $name, mixed $value) use ($context) : void{
        static $count = 0;
        if($count++ < 10){
            $this->session->getLogger()->warning(
                "$context: Unexpected JSON property for " . (new \ReflectionClass($object))->getShortName() . ": " . Utils::printable(substr($name, 0, 80))
            );
        }else{
            throw new PacketHandlingException("$context: Too many unexpected JSON properties");
        }
    };
}

The fix caps warnings at 10 per handler invocation and throws PacketHandlingException on further properties, terminating processing of the abusive packet.

Detection Methods for CVE-2026-86200

Indicators of Compromise

Sudden spikes in PocketMine-MP log volume containing repeated Unexpected JSON property for warning entries.
High CPU utilization on the PocketMine-MP process correlated with inbound connections that never complete the login handshake.
Disk space exhaustion on log volumes attached to game server hosts.
Repeated short-lived TCP or UDP sessions from a small set of source IP addresses targeting the Bedrock listener port.

Detection Strategies

Parse PocketMine-MP server logs and alert when the rate of Unexpected JSON property warnings exceeds a baseline threshold within a rolling window.
Instrument the game server host to monitor CPU load and outbound log-write rates for the PocketMine-MP process.
Deploy network telemetry that counts LoginPacket submissions per source IP and flags outliers.

Monitoring Recommendations

Forward PocketMine-MP application logs to a centralized log aggregation platform for continuous review.
Track process-level CPU and memory metrics on all Bedrock server hosts and alert on sustained saturation.
Correlate authentication-handshake failures with source IP reputation feeds to identify abusive clients.

How to Mitigate CVE-2026-86200

Immediate Actions Required

Upgrade all PocketMine-MP deployments to version 5.42.1 or later without delay.
Audit exposed Bedrock listener ports and restrict access to trusted networks where feasible.
Rotate log storage and provision additional capacity if prior exploitation is suspected.
Review server dashboards for CPU exhaustion patterns matching the described attack behavior.

Patch Information

The upstream fix is implemented in commit c1d4a813fb8c21bfd8b9affd040da864b794df71 and shipped in PocketMine-MP 5.42.1. The patch caps warning generation at ten per handler invocation and raises a PacketHandlingException when the limit is exceeded, forcing the offending session to terminate. Additional context is available in the GitHub Security Advisory GHSA-xp4f-g2cm-rhg7 and the VulnCheck Advisory.

Workarounds

Place PocketMine-MP behind a rate-limiting proxy or firewall that caps new connections per source IP.
Increase the log level for the network session component to suppress warning entries until patching is complete.
Rotate and truncate PocketMine-MP logs aggressively to prevent disk exhaustion.
Restrict inbound access to the Bedrock listener port to allow-listed client networks where operationally feasible.

bash

# Example: verify installed PocketMine-MP version and upgrade
./bin/php7/bin/php PocketMine-MP.phar --version

# Fetch the patched release
wget https://github.com/pmmp/PocketMine-MP/releases/download/5.42.1/PocketMine-MP.phar

# Replace the existing PHAR and restart the service
mv PocketMine-MP.phar /opt/pocketmine/PocketMine-MP.phar
systemctl restart pocketmine-mp