Medium
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
Type: advisorySources: OSV
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86202
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 11:02 UTC · Revision 1
Source evidence
PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket
core-osv · Original sourcePublished 9 Sept 2026, 13:32 UTC
PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.
osv:CVE-2026-86202
Complete source record
{
"id": "5f59f02aede534c308a1b72edc71d613727806b251fb764d1fc0447d0d7ba616",
"url": "https://osv.dev/vulnerability/CVE-2026-86202",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket",
"summary": "PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.",
"evidence": "osv:CVE-2026-86202",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-86202",
"aliases": [
"CVE-2026-86202",
"GHSA-7hmv-4j2j-pp6f"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pmmp/pocketmine-mp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a6ced39472135aacb64cd75b06c5adb452b9db20"
},
{
"fixed": "aeea1150a772a005b92bd418366f1b7cf1a91ab5"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.39.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "aeea1150a772a005b92bd418366f1b7cf1a91ab5"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"5.39.1",
"5.39.0",
"5.38.0",
"5.37.3",
"5.37.2",
"5.37.1",
"5.37.0",
"5.36.0",
"5.35.1",
"5.35.0",
"5.34.1",
"5.34.0",
"5.33.2",
"5.33.1",
"5.33.0",
"5.32.1",
"5.32.0",
"5.31.0",
"5.30.1",
"5.30.0",
"5.29.0",
"5.28.2",
"5.28.1",
"5.28.0",
"5.27.1",
"5.27.0",
"5.26.0",
"5.25.2",
"5.25.1",
"5.25.0",
"5.24.0",
"5.23.3",
"5.23.2",
"5.23.1",
"5.23.0",
"5.22.0",
"5.21.2",
"5.21.1",
"5.21.0",
"5.20.1",
"5.20.0",
"5.16.0",
"5.15.0",
"5.14.1",
"5.14.0",
"5.13.0",
"5.12.1",
"5.12.0",
"5.11.2",
"5.11.1",
"5.11.0",
"5.10.0",
"5.9.0",
"5.8.2",
"5.8.1",
"5.7.1",
"5.7.0",
"5.6.1",
"5.6.0",
"5.5.0",
"5.4.4",
"5.4.3",
"5.4.2",
"5.4.1",
"5.4.0",
"5.3.4",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.1",
"5.2.0",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.1",
"5.0.0",
"4.21.1",
"4.20.4",
"4.21.0",
"4.20.3",
"4.20.2",
"4.20.1",
"4.20.0",
"4.19.3",
"4.19.2",
"4.19.1",
"4.19.0",
"4.18.0",
"4.18.0-ALPHA2",
"4.18.0-ALPHA1",
"4.16.0",
"4.15.3",
"4.15.2",
"4.15.1",
"4.15.0",
"4.14.1",
"4.14.0",
"4.13.0",
"4.12.10",
"4.12.9",
"4.12.8",
"4.12.7",
"4.12.6",
"4.12.5",
"4.12.4",
"4.12.3",
"4.12.2",
"4.12.1",
"4.12.0",
"4.10.2",
"4.10.1",
"4.10.0",
"4.9.1",
"4.9.0",
"4.8.1",
"4.8.0",
"4.7.3",
"4.7.2",
"4.7.1",
"4.7.0",
"4.6.2",
"4.6.1",
"4.6.0",
"4.5.2",
"4.5.1",
"4.5.0",
"4.4.2",
"4.4.1",
"4.4.0",
"4.4.0-BETA1",
"4.1.0-BETA2",
"4.1.0-BETA1",
"4.0.0",
"3.26.1",
"3.26.0",
"3.25.6",
"3.25.5",
"3.25.4",
"3.25.3",
"3.25.2",
"3.25.1",
"3.25.0",
"3.24.0",
"3.23.1",
"3.23.0",
"3.22.5",
"3.22.4",
"3.22.3",
"3.22.2",
"3.22.1",
"3.22.0",
"3.21.1",
"3.21.0",
"3.20.0",
"3.19.3",
"3.19.2",
"3.19.1",
"3.18.2",
"3.19.0",
"3.18.1",
"3.17.7",
"3.18.0",
"3.17.6",
"3.17.5",
"3.17.4",
"3.17.3",
"3.17.2",
"3.17.1",
"3.17.0",
"3.16.1",
"3.16.0",
"3.15.4",
"3.15.3",
"3.15.2",
"3.15.1",
"3.15.0",
"3.14.3",
"3.14.2",
"3.14.1",
"3.14.0",
"3.13.1",
"3.13.0",
"3.12.6",
"3.12.5",
"3.12.4",
"3.12.3",
"3.12.2",
"3.12.1",
"3.11.7",
"3.12.0",
"3.11.6",
"3.11.5",
"3.11.4",
"3.11.3",
"3.11.2",
"3.11.1",
"3.10.1",
"3.11.0",
"3.9.8",
"3.10.0",
"3.9.7",
"3.9.6",
"3.9.5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.7",
"3.8.6",
"3.8.5",
"3.8.4",
"3.8.3",
"3.8.2",
"3.8.1",
"3.8.0",
"3.7.3",
"3.7.2",
"3.7.1",
"3.7.0",
"3.6.5",
"3.6.4",
"3.6.3",
"3.6.2",
"3.6.1",
"3.6.0",
"3.5.10",
"3.5.9",
"3.5.8",
"3.5.7",
"3.5.6",
"3.5.5",
"3.5.4",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.0",
"3.4.1",
"3.4.0",
"3.2.0",
"3.0.2",
"3.0.1",
"3.0.0",
"api/3.0.0-ALPHA12",
"1.7dev-937",
"api/3.0.0-ALPHA11",
"1.7dev-677",
"api/3.0.0-ALPHA10",
"1.7dev-501",
"api/3.0.0-ALPHA8",
"1.7dev-83",
"api/3.0.0-ALPHA6",
"1.6.2dev-229",
"api/3.0.0-ALPHA4",
"api/3.0.0-ALPHA3",
"api/3.0.0-ALPHA2",
"api/3.0.0-ALPHA1",
"api/2.1.0",
"1.6.1dev-87",
"api/2.0.0",
"1.6dev",
"api/1.11.0",
"1.4.1",
"1.4.1dev-936",
"1.4-916",
"1.4",
"Alpha_1.4dev-900",
"Alpha_1.4dev-855",
"Alpha_1.4dev-847",
"Alpha_1.4dev-842",
"Alpha_1.4dev-834",
"Alpha_1.4dev-707",
"Alpha_1.4dev-665",
"Alpha_1.4dev-659",
"Alpha_1.4dev-599",
"Alpha_1.4dev-576",
"Alpha_1.4dev-491",
"Alpha_1.4dev-478",
"Alpha_1.4dev-449",
"Alpha_1.4dev-413",
"Alpha_1.4dev-277",
"Alpha_1.4dev-228",
"Alpha_1.3.10",
"Alpha_1.3.9",
"Alpha_1.3.8",
"Alpha_1.3.7",
"Alpha_1.3.5",
"Alpha_1.3.4",
"Alpha_1.3.3",
"Alpha_1.3.2",
"Alpha_1.3.1",
"Alpha_1.3",
"Alpha_1.2.1",
"Alpha_1.2",
"Alpha_1.1.1",
"Alpha_1.1",
"Alpha_1.0.8",
"Alpha_1.0.7",
"Alpha_1.0.6",
"Alpha_1.0.5",
"Alpha_1.0.4",
"Alpha_1.0.3",
"Alpha_1.0.2",
"Alpha_1.0.1",
"Alpha_1.0",
"pocketmine-mp-rebrand"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86202.json"
}
}
],
"modified": "2026-10-28T02:30:28.343419339Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86202.json",
"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-7hmv-4j2j-pp6f",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86202",
"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-network-amplification-via-actoreventpacket",
"https://github.com/pmmp/PocketMine-MP/commit/aeea1150a772a005b92bd418366f1b7cf1a91ab5"
],
"provider_metadata": {
"cwe_ids": [
"CWE-406"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86202.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86202",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494828,
"published_at": "2026-09-09T13:32:03.254+00:00"
}