CVE-2026-86198
Medium · 4.2CVSS
4.2
EPSS
0.4%
Published
Sep 9, 2026
CISA due date
—
The record
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-45734 MyBB is free and open source forum software. CWE-837
- CVE-2026-42609 Grav is a file-based Web platform. CWE-837
- CVE-2026-44601 Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client… CWE-837
- CVE-2025-62784 InventoryGui allows item duplication in GUIs which use GuiStorageElement CWE-837
- CVE-2024-11716 While assignment of a user to a team (bracket) in CTFd should be possible only once, at… CWE-837