CVE-2026-111210
7.3HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-918
Impact
Remote, unauthenticated attackers can trigger server-side request forgery (SSRF) to reach internal services or leak data. Exploitation requires only network access to send a crafted payment request.
Root cause
The payment request handler insecurely opens arbitrary URLs via url.openConnection in PaymentSession.java when parsing the pki_type argument.
Affected systems
bitcoinj up to 0.17
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No fixed version is currently available as the vendor has not responded. Block untrusted outbound network requests from services running bitcoinj, or disable the payment request handling functionality in PaymentSession.java until a patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.