CVE-2026-86201 PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

CVE-2026-86200

PocketMine-MP versions before 5.42.1 contain a denial-of-service vulnerability in the LoginPacket handler. An unauthenticated remote attacker can craft malicious login packets with excessive unknown properties injected into the clientData JWT , causing the server to flood warning messages and was...