PT-2026-89005
CVE-2026-86202
·
تاريخ النشر
2026-04-06
·
تاريخ التحديث
2026-09-09
الوصف من
CVSS 4.0
5.3
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
PocketMine-MP versions prior to 5.39.2
Description
A network amplification issue exists in the handling of
ActorEventPacket. This allows a client to trigger consuming animations for all visible players by sending crafted ActorEventPacket messages. This behavior can be abused to spam animation events to other clients, leading to the exhaustion of server CPU and memory resources.Recommendations
Update to version 5.39.2 or later.
As a temporary workaround, use a plugin with
DataPacketDecodeEvent to rate-limit ActorEventPacket. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾