---
id: "CVE-2026-111210"
kind: "vulnerability"
aliases: ["CVE-2026-111210"]
title: "bitcoinj: PaymentSession request handler allows server-side request forgery"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bitcoinj-core", "fixed": [], "affected": "<= 0.17", "ecosystem": "maven"}]
ecosystems: []
tags: ["bip-70", "bitcoin", "bitcoinj", "java", "jvm", "no-fix", "package", "ssrf"]
not_affected_if: ["bip70-disabled", "egress-filtered", "no-payment-request-handling"]
published_at: "2026-10-16T00:17:04+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:49:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111210", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:49:57+00:00"}]
---

# bitcoinj: PaymentSession request handler allows server-side request forgery

bitcoinj through 0.17 (every release with BIP-70 support, 0.11.x onward) sends the BIP-70 Payment message to the payment_url from a remote PaymentRequest with no scheme, host or private-address checks, so a crafted bitcoin: URI (r= parameter) makes the host POST signed transactions and the refund address to an attacker-chosen or internal address, including cloud metadata. Setting pki_type=none skips certificate checks, and a valid signature does not cover the URL. The reporter says the victim must confirm the payment. No fix and no maintainer reply as of 2026-10-25.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:bitcoinj-core affected <= 0.17 fixed ?

## How to check

- Find bitcoinj in build.gradle or pom.xml (org.bitcoinj:bitcoinj-core, or legacy com.google:bitcoinj) and check whether it is 0.17 or earlier; all are affected.
- Search the code for PaymentSession, createFromBitcoinUri, createFromUrl and sendPayment, and for bitcoinj-tools WalletTool/PaymentProtocolTool. If none of them handle externally supplied payment requests, you are not exposed.

## Fix

No fixed version exists as of 2026-10-25 (issue bitcoinj/bitcoinj#4386 open, no maintainer reply or fix PR). Workaround: do not process BIP-70 payment requests (r= URIs) from untrusted sources; disable BIP-70 where not needed; or validate payment_url yourself (https only, reject loopback/link-local/private addresses) before sending; block egress to internal networks and 169.254.169.254.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111210
- 2026-10-25T03:49:57+00:00 analyst — Read reporter's issue bitcoinj#4386 (public PoC-level detail, no maintainer reply, no fix) and 0xCERT advisory. Real sink is BIP-70 payment_url -> url.openConnection; pki_type=none just skips PKI. No fix exists; not exploited in the wild per sources. Nothing marked verified (no vendor/maintainer text).

## Documents

- [advisory] bitcoinj #4386: SSRF in PaymentSession (BIP-70) https://github.com/bitcoinj/bitcoinj/issues/4386
- [describes] 0xCERT-2026-0245 bitcoinj SSRF, no fix available https://www.0xcert.com/advisory/0xCERT-2026-0245

## From the sources

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_