CVE-2026-111210
bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 15, 2026
Description
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
bitcoinjn/a |
|
References
- VDB-420761 | bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgeryvdb-entrytechnical-description
- VDB-420761 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-111210 | CVE Analysis and Reportthird-party-advisory
- Submit #1004847 | bitcoinj <=0.17 SSRFthird-party-advisory
- https://github.com/bitcoinj/bitcoinj/issues/4386exploitissue-tracking
- https://github.com/bitcoinj/bitcoinj/security/advisories/GHSA-cqq6-f9cp-chrpbroken-link
- https://github.com/bitcoinj/bitcoinj/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.