CVE-2026-86203

LowCVSS 3.7/10Last modified Oct 8, 2026

Description

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-664

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-862046.5PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to CVE-2026-862055.4h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative CVE-2026-862066.9A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central CVE-2026-862077.7An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs CVE-2026-862087.3A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /d CVE-2026-862097.3A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_CVE-2026-86218.8Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other own CVE-2026-862107.3A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unk CVE-2026-862117.3A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the compone CVE-2026-862124.3A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation le CVE-2026-862137.3A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/universi CVE-2026-862147.3A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This