low3.7
CVE-2026-86203
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients.
Impact
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.
Affected products
| Product | Affected versions |
|---|---|
| PocketMine-MP | before 5.39.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.