CVE-2026-86202

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.39.2

Description A network amplification issue exists in the handling of ActorEventPacket. This allows a client to trigger consuming animations for all visible players by sending crafted ActorEventPacket messages. This behavior can be abused to spam animation events to other clients, leading to the exhaustion of server CPU and memory resources.

Recommendations Update to version 5.39.2 or later. As a temporary workaround, use a plugin with DataPacketDecodeEvent to rate-limit ActorEventPacket.