CVE-2026-86198: Improper Enforcement of a Single, Unique Action in pmmp PocketMine-MP
PocketMine-MP versions before 5.44.2 improperly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED during resource pack handling. This flaw allows malicious clients to send repeated packets that trigger pre-spawn progression multiple times, resulting in duplicate Player objects. The duplication can increase memory consumption and network traffic. The vulnerability has a low severity score and no known exploits in the wild. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
CVE-2026-86198 affects PocketMine-MP versions prior to 5.44.2, where the software fails to enforce a single, unique action during resource pack handling. Specifically, it does not properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, allowing malicious clients to send batches of these packets. This causes repeated triggering of pre-spawn progression, which creates duplicate Player objects and amplifies memory and network resource usage.
Potential Impact
The vulnerability can lead to increased memory consumption and network traffic due to the creation of duplicate Player objects. This may degrade server performance but does not directly indicate remote code execution or data compromise. The CVSS score of 2.3 reflects a low severity impact with partial attack complexity and limited privileges required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for unusual resource consumption patterns and consider limiting client packet rates if possible.
CVE-2026-86198: Improper Enforcement of a Single, Unique Action in pmmp PocketMine-MP
Description
PocketMine-MP versions before 5.44.2 improperly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED during resource pack handling. This flaw allows malicious clients to send repeated packets that trigger pre-spawn progression multiple times, resulting in duplicate Player objects. The duplication can increase memory consumption and network traffic. The vulnerability has a low severity score and no known exploits in the wild. No official patch or remediation guidance is currently available.
CVSS v4.0
Score 2.3low
Affected software
pkg:github/pmmp/PocketMine-MPRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86198 affects PocketMine-MP versions prior to 5.44.2, where the software fails to enforce a single, unique action during resource pack handling. Specifically, it does not properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status, allowing malicious clients to send batches of these packets. This causes repeated triggering of pre-spawn progression, which creates duplicate Player objects and amplifies memory and network resource usage.
Potential Impact
The vulnerability can lead to increased memory consumption and network traffic due to the creation of duplicate Player objects. This may degrade server performance but does not directly indicate remote code execution or data compromise. The CVSS score of 2.3 reflects a low severity impact with partial attack complexity and limited privileges required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for unusual resource consumption patterns and consider limiting client packet rates if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T11:52:36.821Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa164b2acd9273b496858fa
Added to database: 09/09/2026, 13:52:50 UTC
Last enriched: 09/09/2026, 14:24:06 UTC
Last updated: 09/09/2026, 21:30:09 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.