{"id":"CVE-2026-86200","title":"PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT","summary":"PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-779"],"vendor":"pmmp","product":"PocketMine-MP","affected":["PocketMine-MP < 5.42.1"],"published":"2026-09-09","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:18.523","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86200","references":[{"url":"https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71","label":"disclosure@vulncheck.com"},{"url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00467,"epssPercentile":0.39516,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T17:09:28.770848Z"},"ingestedAt":"2026-09-14T10:57:02.620Z","slug":"CVE-2026-86200","body":"## Overview\n\nPocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}