---
id: CVE-2026-86200
title: >-
  PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability
  in the LoginPacket handler that allows remote attackers to flood warning
  messages by injecting numerous junk properties into the clientData JWT
summary: >-
  PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability
  in the LoginPacket handler that allows remote attackers to flood warning
  messages by injecting numerous junk properties into the clientData JWT.
  Attackers can…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-779
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 5.42.1
published: '2026-09-09'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:18.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86200'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/c1d4a813fb8c21bfd8b9affd040da864b794df71
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-xp4f-g2cm-rhg7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-5.42.1-logdos-via-loginpacket-clientdata-jwt
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00637
epssPercentile: 0.48276
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T17:09:28.770848Z'
ingestedAt: '2026-09-14T10:57:02.620Z'
---

## Overview

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.