CVE-2026-86202 — PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visib…
Published: 2026-09-09 · CVSS: 5.3 · CVSS 4.0
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7