CVE-2026-86200

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.42.1

Description A denial of service issue exists in the LoginPacket handler. Remote attackers can inject numerous junk properties into the clientData JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This occurs because the JsonMapper instance used to process the JWT body is configured to warn about unexpected properties rather than rejecting them. By crafting malicious login packets with excessive unknown properties, an attacker can cause the server to flood warning messages and waste CPU time, leading to degraded performance.

Recommendations Update to version 5.42.1 or later. As a temporary workaround, plugins can handle DataPacketReceiveEvent to capture LoginPacket and pre-process the clientData JWT by using JsonMapper with the bExceptionOnUndefinedProperty flag set to true to reject problematic tokens.