CVE-2026-86200 — PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting num…
Published: 2026-09-09 · CVSS: 6.9 · CVSS 4.0
PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7