CVE-2026-111210 in bitcoinj
Summary
by MITRE • 10/16/2026
A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in bitcoinj versions up to 0.17 represents a critical security flaw within the Payment Request Handler component, specifically affecting the url.openConnection function located in the PaymentSession.java file. This weakness stems from insufficient validation of user-supplied input regarding the pki_type argument. When an attacker manipulates this parameter, they can bypass expected constraints and force the application to initiate network connections to arbitrary destinations controlled by the adversary. This behavior is characteristic of Server-Side Request Forgery, a class of vulnerabilities where a server makes requests that appear legitimate but are actually driven by malicious input, allowing attackers to interact with internal or external systems from the perspective of the vulnerable service.
From an operational standpoint, this vulnerability enables remote exploitation without requiring prior authentication in many configurations involving payment request processing. The ability to launch such attacks remotely significantly expands the attack surface, as any entity capable of submitting a manipulated payment request can potentially exploit the flaw. The consequences of successful exploitation are severe and multifaceted. Attackers may use SSRF to probe internal network services that are not exposed to the public internet, leading to unauthorized access to sensitive data or administrative interfaces within private networks. Furthermore, if the bitcoinj instance is running with elevated privileges or has access to cloud metadata endpoints, attackers could potentially extract credentials, configuration details, or other highly sensitive information stored in those locations. The fact that this exploit has been publicly disclosed and may be utilized indicates an immediate risk to any production systems still operating on affected versions, necessitating urgent attention from security teams responsible for maintaining bitcoin-based infrastructure.
The technical classification of this flaw aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where a web server makes requests based on user input without proper validation. In the context of ATT&CK techniques, this vulnerability facilitates T1571, Non-Standard Port Communication, and potentially T1046, Network Service Discovery, depending on how the forged request is utilized to map out internal network topologies or access services running on non-standard ports that are typically protected by firewalls. The lack of response from the project maintainers despite early notification through an issue report highlights a gap in the security update lifecycle for this specific library version, leaving users exposed until they can implement their own mitigations or upgrade to a patched release if one becomes available.
Mitigation strategies must focus on immediate remediation and long-term architectural improvements. The most effective solution is to upgrade bitcoinj to a version where the url.openConnection function properly validates and restricts the pki_type argument, ensuring that only expected certificate types are processed. In cases where an upgrade is not immediately feasible, organizations should implement strict input validation at the application layer to reject any unexpected values for the pki_type parameter before it reaches the vulnerable code path. Additionally, deploying network-level controls such as egress filtering can significantly reduce the impact of SSRF attacks by restricting outbound connections from the server to only those domains and ports that are explicitly required for business operations. This prevents attackers from reaching internal resources or external malicious endpoints even if they successfully manipulate the application input. Regular security audits and code reviews focusing on network interaction functions should also be conducted to identify similar vulnerabilities in other components of the payment processing pipeline, ensuring a more robust defense against remote exploitation attempts.