GHSA-7hmv-4j2j-pp6f CVE-2026-86202
PocketMine-MP: Network amplification vulnerability with `ActorEventPacket`
- Severity
- 5.3 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.35%
- Chance of exploitation in the next 30 days. Higher than 29.19% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
- Fix
5.39.2- Upgrade pocketmine/pocketmine-mp to this version or later
Description
Impact
The server handles ActorEventPacket to trigger consuming animations from vanilla clients when they eat food or drink potions.
This can be abused to make the server spam other clients, and to waste server CPU and memory. For every ActorEventPacket sent by the client, an animation event will be sent to every other player the attacker is visible to.
This is similar to various other vulnerabilities which were fixed in the network overhaul of PM4 (e.g. AnimatePacket and LevelSoundEventPacket), but somehow this one slipped through the net.
Patches
The problem was addressed in aeea1150a772a005b92bd418366f1b7cf1a91ab5 by changing the mechanism for consuming animations to be fully controlled by the server. ActorEventPacket from the client is now discarded.
Workarounds
A plugin could use DataPacketDecodeEvent to rate-limit ActorEventPacket to prevent the attack.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pocketmine/pocketmine-mp | < 5.39.2 |
5.39.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pocketmine/pocketmine-mp Packagist → 5.39.2
- composer
composer require pocketmine/pocketmine-mp:^5.39.2
Severity breakdown
CVSS 4.0 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
How to prevent it
- Architecture and Design: An application must make network resources available to a client commensurate with the client's access level.
- Policy: Define a clear policy for network resource allocation and consumption.
- Implementation: An application must, at all times, keep track of network resources and meter their usage appropriately.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pg53-p7qp-65cv PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets | Low | Also affects pocketmine/pocketmine-mp |
| GHSA-xp4f-g2cm-rhg7 PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-f9jp-856v-8642 PocketMine-MP: Player entities can still die and drop items in flaggedForDespawn state | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-788v-5pfp-93ff PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-h6rj-3m53-887h PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | High | Also affects pocketmine/pocketmine-mp |
| GHSA-fqqv-56h5-f57g PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-g274-c6jj-h78p PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | Medium | Also affects pocketmine/pocketmine-mp |
| GHSA-h6j3-j35f-v2x7 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time) | High | Also affects pocketmine/pocketmine-mp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor