Is CVE-2026-86204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86204 being exploited in the wild.

How severe is CVE-2026-86204?

Medium severity, with a CVSS score of 6.5, published 9 September 2026.

Which products and versions are affected?

pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=5.39.2.

Is there a fix for CVE-2026-86204?

Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 5.39.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86204 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86204?

Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86204: PocketMine-MP denial of service in ModalFormResponsePacket handling

CVE-2026-86204 · Severity: medium · CVSS 6.5 · Published 2026-09-09

PocketMine-MP is a server software that hosts Minecraft Bedrock Edition multiplayer servers. A flaw in how it processes form response packets allows authenticated players to send extremely large JSON payloads that consume excessive server memory and CPU resources, causing the server to freeze or become completely unresponsive. This can be exploited by any player who has successfully logged in and spawned on the server.

Technologies: pocketmine/pocketmine-mp (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-86204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86204 being exploited in the wild.
How severe is CVE-2026-86204?: Medium severity, with a CVSS score of 6.5, published 9 September 2026.
Which products and versions are affected?: pocketmine/pocketmine-mp (Packagist) ECOSYSTEM:introduced=0,fixed=5.39.2.
Is there a fix for CVE-2026-86204?: Yes. pocketmine/pocketmine-mp (Packagist): upgrade to 5.39.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86204 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86204?: Check whether you run pocketmine/pocketmine-mp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pocketmine/pocketmine-mp (Packagist): upgrade to 5.39.2 or later
```
composer require pocketmine/pocketmine-mp:^5.39.2
```

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the ModalFormResponsePacket handler. The server fails to validate or limit the size of JSON payloads in form response packets before attempting to parse them. An authenticated attacker with an active session can craft and send a ModalFormResponsePacket containing a massive JSON array (e.g., 10+ MB) with millions of elements, causing the server to exhaust memory and CPU during JSON decoding and freeze. The exploit requires network access and an authenticated session (player must be spawned in the world); no special privileges or user interaction is needed. The issue was fixed in version 5.39.2 by limiting individual form responses to 10 KB and avoiding decoding responses for non-existent form IDs.

Affected products

PocketMine PocketMine-MP before 5.39.2

Identifiers

CVE-2026-86204
GHSA-788v-5pfp-93ff

Timeline

2026-04-04: disclosed: GitHub Security Advisory GHSA-788v-5pfp-93ff published
2026-09-09: advisory: CVE-2026-86204 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.