bitcoinj up to 0.17: SSRF in BIP-70 PaymentSession via attacker-controlled payment_url, no fix available

Summary

CVE-2026-111210 (CVSS 3.1 7.3, assigned by VulDB) is a server-side request forgery in the BIP-70 Payment Protocol handler of the bitcoinj Java Bitcoin library. PaymentSession passes the payment_url from a remote PaymentRequest to url.openConnection() with no scheme allowlist and no check for private, loopback or link-local hosts. Setting pki_type to "none" skips the PKI check entirely, and the reporter notes that even a valid x509+sha256 signature does not cover the destination URL.

Affected

• bitcoinj up to and including 0.17 (component: Payment Request Handler, PaymentSession.java; the reporter tested 0.11.3 and 0.17 and reviewed 0.12 through 0.16 in source)
• Downstream, the reporter lists bitcoinj-tools (WalletTool, PaymentProtocolTool) and some forks as affected
• No fix available at time of publication. The issue (bitcoinj/bitcoinj#4386, opened 2026-09-29 after a GitHub security advisory got no response) has no maintainer reply or fix PR.

Impact

A malicious bitcoin: URI with an r= parameter, a QR code, a link or an email can deliver a PaymentRequest that points payment_url at an internal or cloud-metadata address. The signed Payment message, which contains the transactions and refund address, is then sent to the attacker-chosen host, and the response memo is returned to the caller. Non-HTTP schemes such as file: and ftp: are not filtered either. NVD's CVSS vector marks it as needing no user interaction, but the reporter says the victim must confirm the payment. VuDB states that the exploit has been publicly disclosed. This advisory has no confirmation of exploitation in the wild.

Recommended actions

• Do not process BIP-70 payment requests (r= URIs) from untrusted sources with bitcoinj, and disable BIP-70 support where it is not required.
• If BIP-70 must stay enabled, enforce https, resolve and pin the destination host, and reject loopback, site-local, link-local, wildcard and multicast addresses before connecting.
• Run services that embed bitcoinj with egress filtering that blocks internal networks and cloud metadata endpoints.
• Watch the bitcoinj issue tracker for a fixed release.

Source & attribution

This 0xCERT advisory summarises CVE-2026-111210, published by NVD from a VulDB (CNA) record, and the public report by GitHub user NinjaGPT at https://github.com/bitcoinj/bitcoinj/issues/4386. Details may change; refer to the original sources for the authoritative record.