CVE-2026-111210
Received Received - Intake

Server-Side Request Forgery in bitcoinj Payment Request Handler

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulDB

Description
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111210
EUVD
EUVD-2026-102547

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
n/a bitcoinj 0.1
n/a bitcoinj 0.2
n/a bitcoinj 0.3
n/a bitcoinj 0.4
n/a bitcoinj 0.5
n/a bitcoinj 0.6
n/a bitcoinj 0.7
n/a bitcoinj 0.8
n/a bitcoinj 0.9
n/a bitcoinj 0.10
n/a bitcoinj 0.11
n/a bitcoinj 0.12
n/a bitcoinj 0.13
n/a bitcoinj 0.14
n/a bitcoinj 0.15
n/a bitcoinj 0.16
n/a bitcoinj 0.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111210 is a Server-Side Request Forgery (SSRF) vulnerability in the bitcoinj library affecting the PaymentSession component and BIP-70 Payment Protocol. The issue occurs because the library fetches a PaymentRequest from a remote party and issues an HTTP POST to a URL in the payment_url field without validating it. This allows attackers to send requests to internal network addresses, including loopback and cloud metadata endpoints. The pki_type field can be set to 'none' to bypass certificate verification, enabling unauthenticated requests.

Detection Guidance

To detect this SSRF vulnerability in bitcoinj, monitor network traffic for outbound HTTP POST requests from bitcoinj-based applications to unusual or internal IP addresses. Check logs for PaymentSession.java processing requests with manipulated pki_type fields. Use tools like tcpdump or Wireshark to capture traffic from bitcoinj processes.

Impact Analysis

If you use a bitcoinj-based wallet with BIP-70 enabled, an attacker could trick you into opening a malicious bitcoin URI or PaymentRequest. This could lead to internal network probing, data leaks, and privacy violations as your wallet sends signed transactions and refund addresses to an attacker-controlled host. The attacker may also receive responses from internal services.

Compliance Impact

This vulnerability could lead to data leaks, including exposure of signed transactions and refund addresses, which may violate GDPR (data protection) and HIPAA (privacy) requirements. Unauthorized access to internal systems via SSRF could also result in compliance breaches depending on the data accessed.

Mitigation Strategies

Disable BIP-70 support in bitcoinj-based wallets immediately. Block outbound HTTP POST requests from bitcoinj processes to internal or sensitive IP ranges. Update firewall rules to restrict connections to trusted endpoints only. Consider migrating to alternative payment protocols that do not rely on BIP-70.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart