CVE-2026-86201

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.41.1

Description A denial of service issue exists in the processing of the LoginPacket where large or complex structures within unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPacket messages containing deeply nested or massive object structures to trigger out-of-memory conditions, waste CPU time during serialization, or spam the console, potentially crashing the server. This occurs because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them, and the warnUndefinedJsonPropertyHandler function attempts to export the malicious object without length limitations.

Recommendations Update to version 5.41.1 or later. As a temporary workaround, plugins can handle the DataPacketReceiveEvent to capture the LoginPacket and pre-process the clientData JWT by setting the bExceptionOnUndefinedProperty flag to true using JsonMapper to reject unusual properties.