Description
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Published: 2026-09-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the handling of ActorEventPacket in PocketMine-MP versions prior to 5.39.2. Clients can send specially crafted ActorEventPacket messages that cause the server to broadcast consumption animation messages for every visible player, leading to increased CPU and memory usage. This amplification effect can degrade server performance and potentially cause a denial of service under sustained attack. The weakness is categorized as CWE-406, reflecting incomplete verification of the packet data.

Affected Systems

The affected product is PocketMine-MP, released by pmmp. Versions before 5.39.2 are impacted, meaning any server running these older releases is vulnerable. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate impact. No EPSS data is available, and the vulnerability is not listed in CISA KEV, suggesting no known wild exploitation yet. Attackers can trigger the issue from any remote client by sending malicious packets, so the primary vector is network-based with no authentication requirement. Once triggered, the amplified animation events exhaust server resources, reducing the quality of service or causing a crash under heavy load.

Generated by OpenCVE AI on September 9, 2026 at 15:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update PocketMine-MP to version 5.39.2 or newer.
  • Apply network rate limiting to ActorEventPacket traffic.
  • Disable or limit consumption animation triggers for untrusted clients.

Generated by OpenCVE AI on September 9, 2026 at 15:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
Title PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Weaknesses CWE-406
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T14:45:30.860Z

Reserved: 2026-09-05T11:52:36.821Z

Link: CVE-2026-86202

cve-icon Vulnrichment

Updated: 2026-09-09T14:35:54.830Z

cve-icon NVD

Status : Received

Published: 2026-09-09T14:17:21.400

Modified: 2026-09-09T15:17:14.180

Link: CVE-2026-86202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T16:00:17Z

Weaknesses
  • CWE-406

    Insufficient Control of Network Message Volume (Network Amplification)