CVE-2026-86204

PocketMine-MP versions before 5.39.2 do not limit the size of the JSON payload accepted in ModalFormResponsePacket handling, allowing a resource-consumption denial-of-service condition (CWE-400). An authenticated player can trigger the flaw simply by submitting a modal form response containing a massive JSON array, which forces the server to process it and exhausts memory and CPU until the server becomes unresponsive. An attacker gains only disruption of service — the vulnerability is availability-impacting, with no evidence of remote code execution or data compromise. All operators running PocketMine-MP server builds prior to 5.39.2 are affected, particularly those hosting publicly joinable Minecraft: Bedrock Edition servers where any player account suffices to attack. As of now there is no CISA KEV listing, no known public proof-of-concept, and no confirmed reports of in-the-wild exploitation.

What to do: Upgrade PocketMine-MP to version 5.39.2 or later, which adds size limits to modal form response processing. Until patched, restrict who can join (whitelist or access-control the server) and watch for players submitting unusually large form responses; note the attack requires only an ordinary authenticated player, so no special privileges are needed on the attacker side.