CVE-2026-86204

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 5.39.2

Description Authenticated players can cause a denial of service by sending ModalFormResponsePacket packets containing massive JSON arrays. The server fails to limit the JSON payload size, allowing an attacker to exhaust CPU and memory resources, which renders the server unresponsive. This occurs when the server processes the formData variable, especially if the formId provided does not correspond to an active form.

Recommendations Update PocketMine-MP to version 5.39.2 or later. As a temporary workaround, use DataPacketReceiveEvent in a plugin to check the maximum size of the formData field and ensure the form ID is not repeated.