# Pmmp PocketMine-MP vulnerabilities

Source: https://junglewise.ai/threats/technologies/pocketmine-mp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pocketmine-mp.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 33 vulnerabilities in Pmmp PocketMine-MP: 0 in the last 7 days and 32 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86204, was published on 9 September 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 32
- All time: 33 (0 critical, 0 exploited in the wild)

## About Pmmp PocketMine-MP

PocketMine-MP is a server software implementation of Minecraft: Pocket Edition written in PHP.

## Latest Pmmp PocketMine-MP vulnerabilities

- [CVE-2026-86204: PocketMine-MP denial of service in ModalFormResponsePacket handling](https://junglewise.ai/threats/cve-2026-86204-pocketmine-mp-denial-of-service-in-modalformresponsepacket) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2026-86203: PocketMine-MP item duplication via despawn entity attack race condition](https://junglewise.ai/threats/cve-2026-86203-pocketmine-mp-item-duplication-via-despawn-entity-attack-race) (low, CVSS 3.7, published 9 Sep 2026)
- [CVE-2026-86202: PocketMine-MP network amplification in ActorEventPacket](https://junglewise.ai/threats/cve-2026-86202-pocketmine-mp-network-amplification-in-actoreventpacket) (medium, CVSS 4.3, published 9 Sep 2026)
- [CVE-2026-86201: PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2026-86200: PocketMine-MP denial of service in LoginPacket handler](https://junglewise.ai/threats/cve-2026-86200-pocketmine-mp-denial-of-service-in-loginpacket-handler) (medium, CVSS 5.3, published 9 Sep 2026)
- [CVE-2026-86199: PocketMine-MP certificate validation bypass in offline login](https://junglewise.ai/threats/cve-2026-86199-pocketmine-mp-certificate-validation-bypass-in-offline-login) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2026-86198: PocketMine-MP improper validation of ResourcePackClientResponsePacket](https://junglewise.ai/threats/cve-2026-86198-pocketmine-mp-improper-validation-of) (medium, CVSS 4.2, published 9 Sep 2026)
- [CVE-2025-71418: PocketMine-MP denial of service via unlimited explode() in packet parsing](https://junglewise.ai/threats/cve-2025-71418-pocketmine-mp-denial-of-service-via-unlimited-explode-in-packet) (medium, CVSS 5.3, published 9 Sep 2026)
- [CVE-2025-71417: PocketMine-MP resource pack UUID validation denial of service](https://junglewise.ai/threats/cve-2025-71417-pocketmine-mp-resource-pack-uuid-validation-denial-of-service) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2024-58381: PocketMine-MP denial of service in LoginPacket JSON processing](https://junglewise.ai/threats/cve-2024-58381-pocketmine-mp-denial-of-service-in-loginpacket-json-processing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2024-58380: PocketMine-MP denial of service in BookEditPacket handling](https://junglewise.ai/threats/cve-2024-58380-pocketmine-mp-denial-of-service-in-bookeditpacket-handling) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2023-54396: PocketMine-MP dye color ID validation failure in banner deserialization](https://junglewise.ai/threats/cve-2023-54396-pocketmine-mp-dye-color-id-validation-failure-in-banner) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2023-54395: PocketMine-MP denial-of-service in ModalFormResponsePacket processing](https://junglewise.ai/threats/cve-2023-54395-pocketmine-mp-denial-of-service-in-modalformresponsepacket) (medium, CVSS 4.3, published 9 Sep 2026)
- [CVE-2023-54394: PocketMine-MP missing rate-limit for mismatch inventory transactions](https://junglewise.ai/threats/cve-2023-54394-pocketmine-mp-missing-rate-limit-for-mismatch-inventory) (medium, CVSS 4.3, published 9 Sep 2026)
- [CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54393-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2023-54392: PocketMine-MP NBT tag validation bypass in BlockActorDataPacket](https://junglewise.ai/threats/cve-2023-54392-pocketmine-mp-nbt-tag-validation-bypass-in-blockactordatapacket) (medium, CVSS 6.5, published 9 Sep 2026)
- [CVE-2023-54390: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54390-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2023-54355: PocketMine-MP EC key validation bypass in LoginPacket](https://junglewise.ai/threats/cve-2023-54355-pocketmine-mp-ec-key-validation-bypass-in-loginpacket) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2022-51018: PocketMine-MP input validation bypass in book creation](https://junglewise.ai/threats/cve-2022-51018-pocketmine-mp-input-validation-bypass-in-book-creation) (medium, CVSS 6.5, published 7 Sep 2026)
- [CVE-2022-51017: PocketMine-MP input validation bypass in skin data](https://junglewise.ai/threats/cve-2022-51017-pocketmine-mp-input-validation-bypass-in-skin-data) (high, CVSS 7.5, published 7 Sep 2026)
- [CVE-2022-51016: PocketMine-MP login replay vulnerability without protocol encryption](https://junglewise.ai/threats/cve-2022-51016-pocketmine-mp-login-replay-vulnerability-without-protocol) (medium, CVSS 6.1, published 7 Sep 2026)
- [CVE-2022-51015: PocketMine-MP input validation bypass in PlayerActionPacket](https://junglewise.ai/threats/cve-2022-51015-pocketmine-mp-input-validation-bypass-in-playeractionpacket) (medium, CVSS 6.5, published 7 Sep 2026)
- [CVE-2022-51014: PocketMine-MP unhandled exception in form response handling](https://junglewise.ai/threats/cve-2022-51014-pocketmine-mp-unhandled-exception-in-form-response-handling) (medium, CVSS 6.5, published 7 Sep 2026)
- [CVE-2022-51013: PocketMine-MP input validation bypass in item damage metadata](https://junglewise.ai/threats/cve-2022-51013-pocketmine-mp-input-validation-bypass-in-item-damage-metadata) (medium, CVSS 6.5, published 7 Sep 2026)
- [CVE-2022-51012: PocketMine-MP NBT deserialization denial of service](https://junglewise.ai/threats/cve-2022-51012-pocketmine-mp-nbt-deserialization-denial-of-service) (medium, CVSS 6.5, published 7 Sep 2026)

## Most severe Pmmp PocketMine-MP vulnerabilities

- [CVE-2026-86201: PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2026-86199: PocketMine-MP certificate validation bypass in offline login](https://junglewise.ai/threats/cve-2026-86199-pocketmine-mp-certificate-validation-bypass-in-offline-login) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2022-51017: PocketMine-MP input validation bypass in skin data](https://junglewise.ai/threats/cve-2022-51017-pocketmine-mp-input-validation-bypass-in-skin-data) (high, CVSS 7.5, published 7 Sep 2026)
- [CVE-2024-58381: PocketMine-MP denial of service in LoginPacket JSON processing](https://junglewise.ai/threats/cve-2024-58381-pocketmine-mp-denial-of-service-in-loginpacket-json-processing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54393-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2023-54390: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54390-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2022-51009: PocketMine-MP denial of service in skin geometry JSON parsing](https://junglewise.ai/threats/cve-2022-51009-pocketmine-mp-denial-of-service-in-skin-geometry-json-parsing) (high, CVSS 7.5, published 6 Sep 2026)
- [CVE-2023-54355: PocketMine-MP EC key validation bypass in LoginPacket](https://junglewise.ai/threats/cve-2023-54355-pocketmine-mp-ec-key-validation-bypass-in-loginpacket) (high, CVSS 7.5, published 9 Sep 2026)
- [CVE-2022-51015: PocketMine-MP input validation bypass in PlayerActionPacket](https://junglewise.ai/threats/cve-2022-51015-pocketmine-mp-input-validation-bypass-in-playeractionpacket) (medium, CVSS 6.5, published 7 Sep 2026)
- [CVE-2022-51014: PocketMine-MP unhandled exception in form response handling](https://junglewise.ai/threats/cve-2022-51014-pocketmine-mp-unhandled-exception-in-form-response-handling) (medium, CVSS 6.5, published 7 Sep 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 5 | 0 | 0 |
| 7 Sep 2026 | 27 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Pmmp PocketMine-MP vulnerabilities", https://junglewise.ai/threats/technologies/pocketmine-mp, 9 November 2026.