CVE-2026-86204: PocketMine-MP JSON Payload DOS Vulnerability

CVE-2026-86204 Overview

CVE-2026-86204 is a denial-of-service vulnerability in PocketMine-MP, an open-source server software for Minecraft: Bedrock Edition. Versions before 5.39.2 do not enforce a size limit on JSON payloads processed by the ModalFormResponsePacket handler. Authenticated players can send crafted modal form response packets containing oversized JSON arrays. The server consumes excessive memory and CPU while parsing these payloads, becoming unresponsive to legitimate clients. The vulnerability is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Any authenticated player can render a PocketMine-MP server unresponsive by transmitting a single malformed modal form response packet.

Affected Products

PocketMine-MP versions prior to 5.39.2
Minecraft: Bedrock Edition servers running vulnerable PocketMine-MP builds
Deployments exposing the PocketMine-MP network listener to untrusted players

Discovery Timeline

2026-09-09 - CVE-2026-86204 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86204

Vulnerability Analysis

PocketMine-MP processes client-to-server packets over the RakNet-based Bedrock protocol. The ModalFormResponsePacket carries a player's response to a server-issued modal form and includes a JSON payload representing the submitted form data. Prior to version 5.39.2, the handler decoded this JSON payload without applying an upper bound on payload length or array element count. A single authenticated session can therefore submit arbitrarily large JSON structures for the server to parse and materialize in memory.

Root Cause

The root cause is missing input validation on untrusted network data. The packet handler trusted the client-supplied JSON blob and passed it directly to the decoder. No pre-parse size check, decoded object cap, or streaming boundary was enforced. This maps to CWE-400, uncontrolled resource consumption triggered by attacker-controlled input.

Attack Vector

Exploitation requires only a valid authenticated player session. An attacker joins the server as a normal player and sends one or more ModalFormResponsePacket messages containing a JSON payload with a very large array. The server dedicates CPU cycles to parsing and memory to storing the decoded structure. Repeated or sufficiently large payloads exhaust host resources, blocking the main server tick loop and denying service to other players. Refer to the GitHub Security Advisory GHSA-788v-5pfp-93ff and the VulnCheck Denial of Service Advisory for further technical detail.

Detection Methods for CVE-2026-86204

Indicators of Compromise

Sudden spikes in PocketMine-MP process memory or CPU consumption correlated with a single connected player session
Server tick lag warnings or watchdog timeouts in PocketMine-MP logs shortly after a player joins
Inbound ModalFormResponsePacket frames with payload sizes far exceeding typical form response lengths

Detection Strategies

Instrument the packet pipeline to log decoded JSON payload sizes for ModalFormResponsePacket and alert on outliers
Correlate abnormal server resource usage with per-player packet volume and payload size metrics
Monitor for repeated disconnects, timeouts, or crash-restart cycles that follow a specific account's activity

Monitoring Recommendations

Export PocketMine-MP process metrics (RSS, CPU, tick duration) to a time-series backend for anomaly detection
Retain packet-level telemetry long enough to attribute resource exhaustion events to originating player identities
Track server crash and restart events and alert on abnormal frequency

How to Mitigate CVE-2026-86204

Immediate Actions Required

Upgrade PocketMine-MP to version 5.39.2 or later on all server instances
Restrict server access to trusted players via whitelist while upgrades are staged
Review and revoke sessions for any accounts observed sending oversized modal form response packets

Patch Information

The fix ships in PocketMine-MP 5.39.2, which enforces size limits on JSON payloads handled by ModalFormResponsePacket. Details are documented in the GitHub Security Advisory GHSA-788v-5pfp-93ff. Operators should apply this release through their normal update mechanism and restart the server process.

Workarounds

Apply a whitelist so that only authenticated, trusted players can connect until the patch is deployed
Constrain the PocketMine-MP process with operating system memory limits so exhaustion attempts terminate the process quickly and trigger automatic restart
Rate-limit or drop ModalFormResponsePacket frames above a reasonable byte threshold at a reverse proxy or firewall where feasible

bash

# Example: run PocketMine-MP under a systemd unit with memory bounds
# /etc/systemd/system/pocketmine.service
[Service]
MemoryMax=2G
MemoryHigh=1500M
Restart=on-failure
RestartSec=5s