---
id: CVE-2026-86201
title: >-
  PocketMine-MP before 5.41.1 contains a denial of service vulnerability in
  LoginPacket processing where large or complex structures in unknown clientData
  JWT properties cause excessive logging without sanitization
summary: >-
  PocketMine-MP before 5.41.1 contains a denial of service vulnerability in
  LoginPacket processing where large or complex structures in unknown clientData
  JWT properties cause excessive logging without sanitization. Attackers can
  send craf…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 5.41.1
published: '2026-09-09'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T14:17:15.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86201'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/commit/87d1c0cea09d972fd4c2fafb84dac2ecab7649f0
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-5.41.1-logdos-via-loginpacket-clientdata
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-h6rj-3m53-887h
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T13:18:39.825297Z'
epss: 0.00339
epssPercentile: 0.27451
ingestedAt: '2026-09-14T15:23:07.419Z'
---

## Overview

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.