CVE-2026-86201

PocketMine-MP before 5.41.1 contains a denial-of-service vulnerability (CWE-400) in the processing of LoginPackets. During login, unknown properties in the clientData JWT are logged without sanitization, so a crafted LoginPacket containing deeply nested or extremely large object structures generates excessive logging and can drive the server into an out-of-memory condition. An unauthenticated remote attacker needs no credentials or user interaction to crash an affected server, interrupting gameplay for all connected players until the process is restarted. Any operator running PocketMine-MP prior to version 5.41.1 is affected. No public proof-of-concept has been published and the flaw is not listed in CISA KEV, so exploitation is not currently known.

What to do: Upgrade to PocketMine-MP 5.41.1 or later, which fixes the LoginPacket handling issue. Until patched, minimize exposure of the Bedrock game port to untrusted networks and monitor server logs and memory for crashes triggered at login. No public exploit exists yet, but any unauthenticated player can trigger the flaw, so treat internet-exposed servers as at risk.