CVE-2026-86201: PocketMine-MP DOS Vulnerability

CVE-2026-86201 Overview

CVE-2026-86201 is a denial of service vulnerability in PocketMine-MP versions before 5.41.1. The flaw resides in LoginPacket processing, where unknown clientData JWT properties are logged without sanitization. An unauthenticated remote attacker can send a crafted LoginPacket containing deeply nested or oversized object structures. The server then attempts to serialize these structures into log output, exhausting available memory. The result is an out-of-memory crash that terminates the game server process.

Critical Impact
Unauthenticated attackers can crash PocketMine-MP servers remotely by sending a single malformed login packet, disrupting availability for all connected players.

Affected Products

PocketMine-MP versions prior to 5.41.1
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Any PocketMine-MP deployment exposing the login handler to untrusted network clients

Discovery Timeline

2026-09-09 - CVE-2026-86201 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86201

Vulnerability Analysis

The vulnerability is classified as an Uncontrolled Resource Consumption issue [CWE-400]. PocketMine-MP is a PHP-based server software for Minecraft: Bedrock Edition. When a client connects, it transmits a LoginPacket containing a JSON Web Token (JWT) with a clientData claim describing device and player attributes. The handler in src/network/mcpe/handler/LoginPacketHandler.php iterates over clientData fields and emits debug log entries for properties it does not recognize. Because the logging routine serialized these unknown values without depth or size limits, adversaries can supply arbitrarily large or deeply nested structures. Serialization then consumes memory proportional to input complexity, exceeding the PHP process memory limit and terminating the server.

Root Cause

The root cause is missing input constraints on unknown clientData JWT properties combined with verbose debug logging. The handler treated attacker-controlled JSON as safe input to var_export-style serialization for log messages. No maximum size, nesting depth, or type validation was applied before the value reached the logger.

Attack Vector

Attack requires only network access to the server's Bedrock listener. No authentication, prior session, or user interaction is required. An attacker crafts a JWT with a clientData payload containing a large recursive object or a very long string in an unrecognized key. Submitting this LoginPacket triggers the vulnerable log path and exhausts server memory.

php

// Patch excerpt from src/network/mcpe/handler/LoginPacketHandler.php
 use pocketmine\player\PlayerInfo;
 use pocketmine\player\XboxLivePlayerInfo;
 use pocketmine\Server;
+use pocketmine\utils\Utils;
 use Ramsey\Uuid\Uuid;
 use Ramsey\Uuid\UuidInterface;
 use function chr;

Source: GitHub commit 87d1c0c. The fix introduces Utils helpers to bound the debug output when unknown clientData properties are encountered.

Detection Methods for CVE-2026-86201

Indicators of Compromise

PHP fatal errors referencing Allowed memory size exhaustion originating from the PocketMine-MP process.
Repeated abrupt server crashes shortly after inbound Bedrock login attempts from unfamiliar IP addresses.
Unusually large log entries containing serialized nested arrays or long unknown clientData field values.

Detection Strategies

Parse PocketMine-MP server logs for oversized debug messages emitted by LoginPacketHandler prior to crash events.
Alert on process termination followed by automatic restart cycles on the Minecraft Bedrock UDP listener port (default 19132).
Inspect inbound Bedrock traffic for LoginPacket payloads exceeding expected size thresholds using network telemetry.

Monitoring Recommendations

Track PHP process memory metrics and correlate spikes with new inbound connections.
Monitor the frequency of LoginPacket events per source IP to identify enumeration or spraying behavior.
Retain server crash dumps and network flow records for at least 30 days to support post-incident analysis.

How to Mitigate CVE-2026-86201

Immediate Actions Required

Upgrade PocketMine-MP to version 5.41.1 or later immediately.
Restrict access to the Bedrock listener port using firewall allow-lists where feasible.
Enable rate limiting on new client connections at the network edge to reduce abuse potential.

Patch Information

The fix is available in PocketMine-MP 5.41.1. Details are published in the GitHub Security Advisory GHSA-h6rj-3m53-887h and the VulnCheck Advisory for PocketMine-MP. The upstream code change is tracked in commit 87d1c0c.

Workarounds

Place the PocketMine-MP server behind a reverse proxy or Bedrock-aware load balancer that enforces packet size limits.
Lower the PHP memory_limit for the server process to bound the impact of a single malicious login attempt.
Reduce log verbosity for the network handler in configuration to avoid serializing untrusted client input.

bash

# Upgrade PocketMine-MP to the patched release
./bin/php7/bin/php ./PocketMine-MP.phar --update --channel=stable

# Verify installed version is 5.41.1 or later
./bin/php7/bin/php ./PocketMine-MP.phar --version