A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery.
It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:bitcoinj
References 7
https://github.com/bitcoinj/bitcoinj/
cna@vuldb.com
https://github.com/bitcoinj/bitcoinj/issues/4386
cna@vuldb.com
https://github.com/bitcoinj/bitcoinj/security/advisories/GHSA-cqq6-f9cp-chrp
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-111210
cna@vuldb.com
https://vuldb.com/submit/1004847
cna@vuldb.com
https://vuldb.com/vuln/420761
cna@vuldb.com
https://vuldb.com/vuln/420761/cti
cna@vuldb.com