CVE-2026-86203
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Sep 09, 2026
Vendor
unknown
Description
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for duplication.