CVE-2026-86204

EUVD-2026-74915
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket
https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff