CVE-2026-86204

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-862055.4h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative CVE-2026-862066.9A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central CVE-2026-862077.7An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs CVE-2026-862087.3A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /d CVE-2026-862097.3A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_CVE-2026-86218.8Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other own CVE-2026-862107.3A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unk CVE-2026-862117.3A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the compone CVE-2026-862124.3A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation le CVE-2026-862137.3A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/universi CVE-2026-862147.3A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This CVE-2026-862154.3A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/serv