CVE-2026-86203

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.39.2

Description The software fails to validate the despawn state of an entity when processing attack packets from clients. When an entity or player is flagged for despawn (such as during a disconnect sequence), it remains accessible in the World entity table. A race condition occurs when a client sends an attack packet at the exact moment an entity is disconnecting, allowing the death handler to execute multiple times. This results in the duplication of experience and inventory items, as they are dropped multiple times while the original items remain with the disconnecting player.

Recommendations Update to version 5.39.2 or later. As a temporary workaround, use plugins to handle EntityDamageByEntityEvent, check if the victim entity is flagged for despawn, and cancel the event if it is.