Executive brief
PocketMine-MP is a server software that hosts Minecraft Bedrock Edition multiplayer servers. A flaw in how it processes form response packets allows authenticated players to send extremely large JSON payloads that consume excessive server memory and CPU resources, causing the server to freeze or become completely unresponsive. This can be exploited by any player who has successfully logged in and spawned on the server.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the ModalFormResponsePacket handler. The server fails to validate or limit the size of JSON payloads in form response packets before attempting to parse them. An authenticated attacker with an active session can craft and send a ModalFormResponsePacket containing a massive JSON array (e.g., 10+ MB) with millions of elements, causing the server to exhaust memory and CPU during JSON decoding and freeze. The exploit requires network access and an authenticated session (player must be spawned in the world); no special privileges or user interaction is needed. The issue was fixed in version 5.39.2 by limiting individual form responses to 10 KB and avoiding decoding responses for non-existent form IDs.
Affected products
- PocketMine PocketMine-MP before 5.39.2
Timeline
- 2026-04-04: disclosed: GitHub Security Advisory GHSA-788v-5pfp-93ff published
- 2026-09-09: advisory: CVE-2026-86204 published on NVD