PT-2026-89001

CVE-2026-86198

Published

2026-09-09

Updated

2026-10-29

Description by

CVSS 3.1

4.2

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.44.2

Description Improper validation of multiple ResourcePackClientResponsePacket packets with STATUS COMPLETED status occurs during resource pack handling. This allows malicious clients to send batches of these packets to repeatedly trigger pre-spawn progression, which results in the creation of duplicate Player objects and increases memory consumption and network traffic.

Recommendations Update to version 5.44.2 or later.

Exploitability

Exploit

Fix

Researchers

Dktapps

Genesizs

Vendors

Affected products

Weakness enumeration

CWE-837: Improper Enforcement of a Single, Unique Action

Related identifiers