CVE-2026-86202: PocketMine-MP Network Amplification DoS Flaw

CVE-2026-86202 Overview

CVE-2026-86202 is a network amplification vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 5.39.2 improperly process ActorEventPacket messages received from clients. An authenticated client can send crafted packets that trigger consuming item animations for all visible players. Each malicious packet is amplified to every observing client, wasting server CPU and memory while spamming animation events across connected sessions. The vulnerability is tracked under [CWE-406: Insufficient Control of Network Message Volume (Network Amplification)].

Critical Impact
Low-privileged network attackers can degrade server performance and disrupt gameplay for all connected players through amplified animation packet spam.

Affected Products

PocketMine-MP versions prior to 5.39.2
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Server operators exposing multiplayer instances to untrusted clients

Discovery Timeline

2026-09-09 - CVE-2026-86202 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86202

Vulnerability Analysis

The flaw resides in PocketMine-MP's in-game packet handler, which trusted ActorEventPacket messages originating from clients. The server relayed these events to all players with visibility of the sending actor. Because a single inbound packet produced multiple outbound packets, the design created an amplification factor proportional to the number of observers. Attackers exploited this to force the server into repeated broadcast loops, consuming CPU cycles and network bandwidth. The vulnerability requires only low privileges — a legitimate authenticated client session — and no user interaction from victims.

Root Cause

The root cause is improper trust of client-supplied entity events. The server allowed clients to dictate animations such as ConsumingItemAnimation for their own actor, then broadcast that state to every visible peer. No rate limiting, validation, or authorization check gated the operation, permitting unbounded reflection of animation events.

Attack Vector

An attacker connects to a target PocketMine-MP server with valid credentials, then transmits crafted ActorEventPacket messages in rapid succession. Each packet is fanned out to observing clients, multiplying network traffic and CPU work per player in the visibility radius.

php

// Security patch (verified from upstream commit)
// File: src/network/mcpe/handler/InGamePacketHandler.php
 use pocketmine\block\Lectern;
 use pocketmine\block\tile\Sign;
 use pocketmine\block\utils\SignText;
-use pocketmine\entity\animation\ConsumingItemAnimation;
 use pocketmine\entity\Attribute;
 use pocketmine\entity\InvalidSkinException;
 use pocketmine\event\player\PlayerEditBookEvent;

// File: src/player/Player.php
 use pocketmine\data\java\GameModeIdMap;
 use pocketmine\entity\animation\Animation;
 use pocketmine\entity\animation\ArmSwingAnimation;
+use pocketmine\entity\animation\ConsumingItemAnimation;
 use pocketmine\entity\animation\CriticalHitAnimation;
 use pocketmine\entity\animation\MagicHitAnimation;
 use pocketmine\entity\Attribute;
// Source: https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5
// The fix moves ConsumingItemAnimation handling to the server side and removes
// client-driven ActorEventPacket processing from the network handler.

Detection Methods for CVE-2026-86202

Indicators of Compromise

High frequency of inbound ActorEventPacket messages from a single client session
Sudden spikes in outbound broadcast traffic disproportionate to inbound volume
Elevated CPU and memory utilization on the PocketMine-MP process without corresponding legitimate player activity
Repeated ConsumingItemAnimation events attributed to a single actor within short time windows

Detection Strategies

Enable verbose packet logging on PocketMine-MP and alert on ActorEventPacket rates that exceed a defined baseline per session
Correlate server performance metrics with per-client packet counts to identify amplification sources
Deploy network flow analysis to compare inbound versus outbound bandwidth ratios per player session

Monitoring Recommendations

Instrument the PocketMine-MP server with metrics exporters that track packet types, per-session rates, and resource consumption
Forward server logs and packet telemetry to a centralized logging platform for baseline analysis and anomaly identification
Set alert thresholds on sustained CPU utilization and outbound traffic amplification factors

How to Mitigate CVE-2026-86202

Immediate Actions Required

Upgrade PocketMine-MP to version 5.39.2 or later without delay
Audit currently connected sessions for anomalous packet rates and terminate suspicious clients
Restrict server access to trusted players using whitelists where operationally feasible

Patch Information

The upstream fix removes client-driven ActorEventPacket handling from InGamePacketHandler.php and relocates animation broadcasting to server-controlled logic in Player.php. Server operators should apply version 5.39.2 by updating through the standard PocketMine-MP release channel. Full details are available in the GitHub Security Advisory GHSA-7hmv-4j2j-pp6f and the upstream commit.

Workarounds

Apply per-client packet rate limiting at the network edge to cap ActorEventPacket volume
Reduce player visibility ranges to lower the amplification factor per malicious packet
Enforce whitelist-only access on production servers until the patch is deployed

bash

# Configuration example - update PocketMine-MP to the patched release
cd /path/to/pocketmine-mp
./start.sh --update
# Verify version after restart
grep -i 'version' server.log | head -n 5
# Confirm running version is 5.39.2 or later