CVE-2026-111210: Server-Side Request Forgery in bitcoinj
Description
CVE-2026-111210 is a server-side request forgery (SSRF) vulnerability in bitcoinj affecting versions 0.1 through 0.17. The flaw exists in the url.openConnection function within the PaymentSession.java file of the Payment Request Handler component. Manipulating the pki_type argument can lead to SSRF, allowing remote attackers to induce the server to make unintended requests. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
CVSS v4.0
Score 6.9medium
Affected software
bitcoinj
pkg:maven/org.bitcoinj/bitcoinjcpe:2.3:a:bitcoinj:bitcoinj:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in bitcoinj up to version 0.17 involves the url.openConnection function in PaymentSession.java. An attacker can manipulate the pki_type argument to trigger server-side request forgery, causing the server to send crafted requests to arbitrary URLs. The issue was reported early to the project, but no fix or response has been issued. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 6.9, indicating medium severity.
Potential Impact
Successful exploitation allows remote attackers to cause the bitcoinj server to make arbitrary HTTP requests, potentially exposing internal resources or enabling further attacks. The vulnerability does not require user interaction or privileges and has partial impact on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported.
Mitigation Recommendations
No official fix or patch is currently available from the vendor. Users should monitor the bitcoinj project for updates or advisories. Until a patch is released, consider restricting network access to the affected component or applying network-level controls to limit outbound requests from the application.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-15T18:08:31.413Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad16d6f2cdf04f6566a6dc2
Added to database: 10/16/2026, 00:18:55 UTC
Last enriched: 10/16/2026, 00:33:17 UTC
Last updated: 10/16/2026, 00:33:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.