What is GHSA-323m-6rhr-p53j?

GHSA-323m-6rhr-p53j is a security advisory published by GitHub Security Advisories with High severity. PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket...

Which CVE IDs does GHSA-323m-6rhr-p53j cover?

GHSA-323m-6rhr-p53j covers the following CVE IDs: CVE-2026-86204. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-323m-6rhr-p53j?

GHSA-323m-6rhr-p53j has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-323m-6rhr-p53jHighCVSS 6.5

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-86204 →

📋 Description

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the server unresponsive.

🔗 References (4)

https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-788v-5pfp-93ff
https://nvd.nist.gov/vuln/detail/CVE-2026-86204
https://www.vulncheck.com/advisories/pocketmine-mp-before-5.39.2-denial-of-service-via-modalformresponsepacket
https://github.com/advisories/GHSA-323m-6rhr-p53j