MEDIUM
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Published Sep 9, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.35%
Description
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Affected products
-
- Version 0StatusaffectedConstraints<5.39.2
- Version 5.39.2StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pmmp | PocketMine-MP | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5 patch
- https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f vendor-advisory
- https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket third-party-advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Sep 9, 2026
Updated Sep 9, 2026
Reserved Sep 5, 2026
Link CVE-2026-86202
CISA Vulnrichment
Updated Sep 9, 2026