Live › vulnerability › CVE-2026-111210
Go to dashboardbitcoinj through 0.17 (every release with BIP-70 support, 0.11.x onward) sends the BIP-70 Payment message to the payment_url from a remote PaymentRequest with no scheme, host or private-address checks, so a crafted bitcoin: URI (r= parameter) makes the host POST signed transactions and the refund address to an attacker-chosen or internal address, including cloud metadata. Setting pki_type=none skips certificate checks, and a valid signature does not cover the URL. The reporter says the victim must confirm the payment. No fix and no maintainer reply as of 2026-10-25.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that embed bitcoinj up to 0.17 and use its Payment Request Handler (PaymentSession) to process payment requests from outside. Sources do not say whether a fixed version exists. Applications that do not use PaymentSession on untrusted input are likely not exposed, but the sources do not confirm this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| bitcoinj-core | maven | <= 0.17 | – |
169.254.169.254Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-111210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.