# pocketmine/pocketmine-mp (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in pocketmine/pocketmine-mp (Packagist): 0 in the last 7 days and 30 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86204, was published on 9 September 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 30 - All time: 31 (0 critical, 0 exploited in the wild) ## About pocketmine/pocketmine-mp (Packagist) Minecraft server software for the Pocket Edition platform written in PHP. ## Latest pocketmine/pocketmine-mp (Packagist) vulnerabilities - [CVE-2026-86204: PocketMine-MP denial of service in ModalFormResponsePacket handling](https://junglewise.ai/threats/cve-2026-86204-pocketmine-mp-denial-of-service-in-modalformresponsepacket) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86203: PocketMine-MP item duplication via despawn entity attack race condition](https://junglewise.ai/threats/cve-2026-86203-pocketmine-mp-item-duplication-via-despawn-entity-attack-race) (low, CVSS 3.7, published 9 Sep 2026) - [CVE-2026-86202: PocketMine-MP network amplification in ActorEventPacket](https://junglewise.ai/threats/cve-2026-86202-pocketmine-mp-network-amplification-in-actoreventpacket) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86201: PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2026-86200: PocketMine-MP denial of service in LoginPacket handler](https://junglewise.ai/threats/cve-2026-86200-pocketmine-mp-denial-of-service-in-loginpacket-handler) (medium, CVSS 5.3, published 9 Sep 2026) - [CVE-2026-86198: PocketMine-MP improper validation of ResourcePackClientResponsePacket](https://junglewise.ai/threats/cve-2026-86198-pocketmine-mp-improper-validation-of) (medium, CVSS 4.2, published 9 Sep 2026) - [CVE-2025-71418: PocketMine-MP denial of service via unlimited explode() in packet parsing](https://junglewise.ai/threats/cve-2025-71418-pocketmine-mp-denial-of-service-via-unlimited-explode-in-packet) (medium, CVSS 5.3, published 9 Sep 2026) - [CVE-2025-71417: PocketMine-MP resource pack UUID validation denial of service](https://junglewise.ai/threats/cve-2025-71417-pocketmine-mp-resource-pack-uuid-validation-denial-of-service) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2024-58381: PocketMine-MP denial of service in LoginPacket JSON processing](https://junglewise.ai/threats/cve-2024-58381-pocketmine-mp-denial-of-service-in-loginpacket-json-processing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2024-58380: PocketMine-MP denial of service in BookEditPacket handling](https://junglewise.ai/threats/cve-2024-58380-pocketmine-mp-denial-of-service-in-bookeditpacket-handling) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2023-54396: PocketMine-MP dye color ID validation failure in banner deserialization](https://junglewise.ai/threats/cve-2023-54396-pocketmine-mp-dye-color-id-validation-failure-in-banner) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2023-54395: PocketMine-MP denial-of-service in ModalFormResponsePacket processing](https://junglewise.ai/threats/cve-2023-54395-pocketmine-mp-denial-of-service-in-modalformresponsepacket) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2023-54394: PocketMine-MP missing rate-limit for mismatch inventory transactions](https://junglewise.ai/threats/cve-2023-54394-pocketmine-mp-missing-rate-limit-for-mismatch-inventory) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54393-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2023-54392: PocketMine-MP NBT tag validation bypass in BlockActorDataPacket](https://junglewise.ai/threats/cve-2023-54392-pocketmine-mp-nbt-tag-validation-bypass-in-blockactordatapacket) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2023-54390: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54390-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2023-54355: PocketMine-MP EC key validation bypass in LoginPacket](https://junglewise.ai/threats/cve-2023-54355-pocketmine-mp-ec-key-validation-bypass-in-loginpacket) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2022-51018: PocketMine-MP input validation bypass in book creation](https://junglewise.ai/threats/cve-2022-51018-pocketmine-mp-input-validation-bypass-in-book-creation) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51017: PocketMine-MP input validation bypass in skin data](https://junglewise.ai/threats/cve-2022-51017-pocketmine-mp-input-validation-bypass-in-skin-data) (high, CVSS 7.5, published 7 Sep 2026) - [CVE-2022-51016: PocketMine-MP login replay vulnerability without protocol encryption](https://junglewise.ai/threats/cve-2022-51016-pocketmine-mp-login-replay-vulnerability-without-protocol) (medium, CVSS 6.1, published 7 Sep 2026) - [CVE-2022-51015: PocketMine-MP input validation bypass in PlayerActionPacket](https://junglewise.ai/threats/cve-2022-51015-pocketmine-mp-input-validation-bypass-in-playeractionpacket) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51014: PocketMine-MP unhandled exception in form response handling](https://junglewise.ai/threats/cve-2022-51014-pocketmine-mp-unhandled-exception-in-form-response-handling) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51013: PocketMine-MP input validation bypass in item damage metadata](https://junglewise.ai/threats/cve-2022-51013-pocketmine-mp-input-validation-bypass-in-item-damage-metadata) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51012: PocketMine-MP NBT deserialization denial of service](https://junglewise.ai/threats/cve-2022-51012-pocketmine-mp-nbt-deserialization-denial-of-service) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51011: PocketMine-MP denial-of-service in chat message parsing](https://junglewise.ai/threats/cve-2022-51011-pocketmine-mp-denial-of-service-in-chat-message-parsing) (medium, CVSS 4.3, published 7 Sep 2026) ## Most severe pocketmine/pocketmine-mp (Packagist) vulnerabilities - [CVE-2026-86201: PocketMine-MP denial of service in LoginPacket processing](https://junglewise.ai/threats/cve-2026-86201-pocketmine-mp-denial-of-service-in-loginpacket-processing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2022-51017: PocketMine-MP input validation bypass in skin data](https://junglewise.ai/threats/cve-2022-51017-pocketmine-mp-input-validation-bypass-in-skin-data) (high, CVSS 7.5, published 7 Sep 2026) - [CVE-2024-58381: PocketMine-MP denial of service in LoginPacket JSON processing](https://junglewise.ai/threats/cve-2024-58381-pocketmine-mp-denial-of-service-in-loginpacket-json-processing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2023-54393: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54393-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2023-54390: PocketMine-MP denial of service in LoginPacket JSON parsing](https://junglewise.ai/threats/cve-2023-54390-pocketmine-mp-denial-of-service-in-loginpacket-json-parsing) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2022-51009: PocketMine-MP denial of service in skin geometry JSON parsing](https://junglewise.ai/threats/cve-2022-51009-pocketmine-mp-denial-of-service-in-skin-geometry-json-parsing) (high, CVSS 7.5, published 6 Sep 2026) - [CVE-2023-54355: PocketMine-MP EC key validation bypass in LoginPacket](https://junglewise.ai/threats/cve-2023-54355-pocketmine-mp-ec-key-validation-bypass-in-loginpacket) (high, CVSS 7.5, published 9 Sep 2026) - [CVE-2022-51015: PocketMine-MP input validation bypass in PlayerActionPacket](https://junglewise.ai/threats/cve-2022-51015-pocketmine-mp-input-validation-bypass-in-playeractionpacket) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51014: PocketMine-MP unhandled exception in form response handling](https://junglewise.ai/threats/cve-2022-51014-pocketmine-mp-unhandled-exception-in-form-response-handling) (medium, CVSS 6.5, published 7 Sep 2026) - [CVE-2022-51013: PocketMine-MP input validation bypass in item damage metadata](https://junglewise.ai/threats/cve-2022-51013-pocketmine-mp-input-validation-bypass-in-item-damage-metadata) (medium, CVSS 6.5, published 7 Sep 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 26 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pocketmine/pocketmine-mp (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/pocketmine-pocketmine-mp, 9 November 2026.