Description
PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Published: 2026-09-09
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

PocketMine-MP before version 5.39.2 does not limit the size of JSON payloads in ModalFormResponsePacket handling. An attacker who is authenticated can send a packet containing an extremely large JSON array, causing the server to allocate excessive memory and consume CPU resources before responding, which can render the server unresponsive.

Affected Systems

PocketMine-MP servers running any version older than 5.39.2 are affected. The vulnerability is tied to the pmmp:PocketMine-MP product line and applies to all deployments of those preceding releases.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity impact. EPSS information is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting that it has not yet been widely exploited in the wild. Attackers must be able to authenticate to the server, after which they can send oversized modal form response packets. Successful exploitation results in a denial of service that can affect all players and disrupt server administration.

Generated by OpenCVE AI on September 9, 2026 at 15:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PocketMine-MP to version 5.39.2 or later, ensuring that the patch enforcing payload size limits is applied.
  • If an immediate upgrade is not feasible, configure the server or deploy a custom plugin to reject modal form responses that exceed a safe payload length.
  • Monitor server logs for unusually large ModalFormResponsePacket payloads and temporarily block offending player accounts while a permanent fix is applied.

Generated by OpenCVE AI on September 9, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.
Title PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T14:19:07.609Z

Reserved: 2026-09-05T11:52:36.822Z

Link: CVE-2026-86204

cve-icon Vulnrichment

Updated: 2026-09-09T14:19:02.907Z

cve-icon NVD

Status : Received

Published: 2026-09-09T14:17:21.690

Modified: 2026-09-09T15:17:14.307

Link: CVE-2026-86204

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T16:00:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption