Improper Input Validation

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Improper Input Validation via the LoginPacket process. An attacker can cause the server to crash by sending...

CVE-2026-86200

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

CVE-2026-86201

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

CVE-2024-58381

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2023-54355

PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exceptio...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54390

PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server...

CVE-2026-86201 PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

CVE-2026-86201

PocketMine-MP versions prior to 5.41.1 are susceptible to a log-based denial of service (LogDoS) vulnerability in LoginPacket processing. The root cause is that large or complex structures in unknown clientData JWT properties trigger excessive logging without sanitization, allowing an unauthentic...

CVE-2026-86201 PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

CVE-2026-86201 PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

EUVD-2026-74912

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

CVE-2026-86200 PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

EUVD-2026-74911

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

CVE-2026-86200 PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

CVE-2026-86200 PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown...

CVE-2026-86200

PocketMine-MP versions before 5.42.1 contain a denial-of-service vulnerability in the LoginPacket handler. An unauthenticated remote attacker can craft malicious login packets with excessive unknown properties injected into the clientData JWT , causing the server to flood warning messages and was...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...