PocketMine-MP versions prior to 5.39.2 do not impose limits on the size of JSON payloads in the handling of ModalFormResponsePacket. This allows authenticated users to send modal form response packets containing excessively large JSON arrays, which can exhaust server memory and CPU resources, leading to denial of service and making the server unresponsive. The vulnerability is identified as CVE-2026-86204 with a CVSS 4.0 base score of 7.1, indicating a high impact. No official patch or remediation level is currently confirmed in the provided data.

Exploitation of this vulnerability results in denial of service by exhausting server memory and CPU resources, rendering the PocketMine-MP server unresponsive. The attack requires authenticated access but does not require user interaction or complex attack vectors. There is no indication of data breach or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting or monitoring authenticated user input sizes if possible or applying any recommended temporary mitigations from the vendor. Avoid exposing the server to untrusted authenticated users where feasible.