CVE-2026-111210: bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
bitcoinj deployments using the Payment Request Handler are affected if they run a version up to 0.17. The vulnerable code is in PaymentSession.java.
What does an attacker need to exploit it?
The attack can be performed remotely without stated authentication or user interaction requirements by manipulating the pki_type argument. Public exploit details are available.
What is the likely impact of successful exploitation?
Successful exploitation can cause server-side request forgery, allowing the affected application to make requests initiated by the server. The reported severity metrics indicate low impact to confidentiality, integrity, and availability.
Is a vendor fix available?
The available information does not identify a fixed version or vendor response. The project was reportedly notified through an issue report but had not responded at the time of reporting.