---
id: CVE-2026-86204
title: >-
  PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in
  ModalFormResponsePacket handling, allowing authenticated players to cause
  denial of service
summary: >-
  PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in
  ModalFormResponsePacket handling, allowing authenticated players to cause
  denial of service. Attackers can send modal form response packets with massive
  JSON arrays …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: pmmp
product: PocketMine-MP
affected:
  - PocketMine-MP < 5.39.2
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:20:21.673'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86204'
references:
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:18:46.084735Z'
ingestedAt: '2026-09-09T14:11:29.380Z'
epss: 0.00436
epssPercentile: 0.35133
---

## Overview

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.