CVE-2026-86201 describes a denial of service vulnerability in PocketMine-MP prior to 5.41.1. The flaw occurs in the processing of LoginPackets where the clientData JWT properties are not sanitized. Malicious actors can exploit this by sending LoginPackets containing deeply nested or massive object structures, causing excessive logging and ultimately exhausting server memory, leading to a crash.

Successful exploitation results in denial of service by crashing the PocketMine-MP server due to out-of-memory conditions triggered by excessive logging of crafted LoginPackets. This disrupts availability but does not indicate privilege escalation or data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 5.41.1, upgrading to 5.41.1 or later is likely recommended once confirmed. Until then, consider limiting or filtering LoginPacket sizes or structures if possible.