{"id":"CVE-2026-111210","kind":"vulnerability","aliases":["CVE-2026-111210"],"related":[],"title":"bitcoinj: PaymentSession request handler allows server-side request forgery","description":"A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"bitcoinj through 0.17 (every release with BIP-70 support, 0.11.x onward) sends the BIP-70 Payment message to the payment_url from a remote PaymentRequest with no scheme, host or private-address checks, so a crafted bitcoin: URI (r= parameter) makes the host POST signed transactions and the refund address to an attacker-chosen or internal address, including cloud metadata. Setting pki_type=none skips certificate checks, and a valid signature does not cover the URL. The reporter says the victim must confirm the payment. No fix and no maintainer reply as of 2026-10-25.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bitcoinj-core","fixed":[],"affected":"<= 0.17","ecosystem":"maven"}],"ecosystems":[],"tags":["bip-70","bitcoin","bitcoinj","java","jvm","no-fix","package","ssrf"],"not_affected_if":["bip70-disabled","egress-filtered","no-payment-request-handling"],"how_to_check":"- Find bitcoinj in build.gradle or pom.xml (org.bitcoinj:bitcoinj-core, or legacy com.google:bitcoinj) and check whether it is 0.17 or earlier; all are affected.\n- Search the code for PaymentSession, createFromBitcoinUri, createFromUrl and sendPayment, and for bitcoinj-tools WalletTool/PaymentProtocolTool. If none of them handle externally supplied payment requests, you are not exposed.","fix":"No fixed version exists as of 2026-10-25 (issue bitcoinj/bitcoinj#4386 open, no maintainer reply or fix PR). Workaround: do not process BIP-70 payment requests (r= URIs) from untrusted sources; disable BIP-70 where not needed; or validate payment_url yourself (https only, reject loopback/link-local/private addresses) before sending; block egress to internal networks and 169.254.169.254.","status":"open","published_at":"2026-10-16T00:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:20+00:00","updated_at":"2026-10-25T03:49:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:25:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"bitcoinj: PaymentSession request handler allows server-side request forgery","impact":"medium","summary":"bitcoinj up to 0.17 has a flaw in PaymentSession.java where the pki_type argument reaches url.openConnection, letting a remote attacker make the server issue requests to arbitrary destinations. The exploit is public and the project has not yet responded to the report.","category":"package","nicknames":[],"who_cares":["bitcoinj","java","jvm","bitcoin"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server makes attacker-chosen internal requests, exposing internal services","analyst_note":"Check the NVD entry and the upstream bitcoinj issue for a fixed version and whether PaymentSession is reachable by default; the sources report no vendor response.","how_to_check":"- Check the bitcoinj version in the project's dependency file (for example `bitcoinj` in build.gradle or pom.xml) and see whether it is `0.17` or earlier\n- Search the codebase for uses of PaymentSession and Payment Request Handler code paths that accept payment request input","needs_analyst":true,"not_affected_if":["no-payment-request-handling"],"who_is_affected":"Applications that embed bitcoinj up to 0.17 and use its Payment Request Handler (PaymentSession) to process payment requests from outside. Sources do not say whether a fixed version exists. Applications that do not use PaymentSession on untrusted input are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3344,"output_tokens":578,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the upstream bitcoinj issue for a fixed version and whether PaymentSession is reachable by default; the sources report no vendor response.","search":"'-10':128B '-111210':13A,16A '-2026':12A,15A '-25':129B '-70':21B,38B,46B '0.11':40B '0.17':33B,138C '2026':127B 'address':64B,82B,90B 'affect':139C 'allow':5A 'argument':159C 'attack':86B,176C 'attacker-chosen':85B 'bip':20B,37B,45B 'bitcoin':22B,69B 'bitcoinj':1A,18A,23B,31B,135C 'bitcoinj-core':17A 'certif':99B 'check':65B,100B 'chosen':87B 'cloud':92B 'compon':150C 'confirm':116B 'core':19A 'cover':107B 'craft':68B 'cve':11A,14A 'determin':133C 'disclos':183C 'earli':195C 'everi':34B 'execut':154C 'exploit':179C 'file':146C 'fix':28B,120B 'forgeri':10A,169C 'function':142C 'handler':4A,153C 'host':60B,75B 'includ':91B 'inform':191C 'intern':89B 'issu':198C 'java':24B 'jvm':25B 'launch':174C 'lead':163C 'maintain':123B 'make':73B 'manipul':156C 'may':185C 'messag':48B 'metadata':93B 'must':115B 'no-fix':26B 'none':97B 'onward':42B 'packag':29B 'paramet':72B 'payment':47B,51B,118B,151C 'paymentrequest':56B 'paymentsess':2A 'paymentsession.java':147C 'pki':95B,160C 'possibl':172C 'post':76B 'privat':63B 'private-address':62B 'problem':194C 'project':189C 'public':182C 'r':71B 'refund':81B 'releas':35B 'remot':55B,177C 'repli':124B 'report':111B,199C 'request':3A,9A,152C,168C 'respond':203C 'say':112B 'scheme':59B 'send':43B 'server':7A,166C 'server-sid':6A,165C 'set':94B 'side':8A,167C 'sign':77B 'signatur':104B 'skip':98B 'ssrf':30B 'support':39B 'transact':78B 'type':96B,161C 'uri':70B 'url':52B,109B 'url.openconnection':143C 'util':187C 'valid':103B 'victim':114B 'vulner':131C 'x':41B 'yet':204C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed bitcoinj up to 0.17 and use its Payment Request Handler (PaymentSession) to process payment requests from outside. Sources do not say whether a fixed version exists. Applications that do not use PaymentSession on untrusted input are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111210","severity":null,"published_at":"2026-10-16T00:17:04+00:00","modified_at":"2026-10-16T19:21:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111210:804","url":null,"severity":null,"published_at":"2026-10-25T03:49:57+00:00","modified_at":"2026-10-25T03:49:57+00:00","first_seen_at":"2026-10-25T03:49:57+00:00","fetched_at":"2026-10-25T03:49:57+00:00","note":"Read reporter's issue bitcoinj#4386 (public PoC-level detail, no maintainer reply, no fix) and 0xCERT advisory. Real sink is BIP-70 payment_url -> url.openConnection; pki_type=none just skips PKI. No fix exists; not exploited in the wild per sources. Nothing marked verified (no vendor/maintainer text)."}],"documents":[{"id":3362,"url":"https://github.com/bitcoinj/bitcoinj/issues/4386","title":"bitcoinj #4386: SSRF in PaymentSession (BIP-70)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3363,"url":"https://www.0xcert.com/advisory/0xCERT-2026-0245","title":"0xCERT-2026-0245 bitcoinj SSRF, no fix available","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}