-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0245 ============================================================ Advisory-ID: 0xCERT-2026-0245 Severity: High Published: 2026-10-16T00:17:04.000Z Updated: 2026-10-16T00:37:03.793Z Chains: Bitcoin URL: https://www.0xcert.com/advisory/0xCERT-2026-0245 Title: bitcoinj up to 0.17: SSRF in BIP-70 PaymentSession via attacker-controlled payment_url, no fix available Summary - ------- bitcoinj through 0.17 sends BIP-70 Payment messages to an unvalidated payment_url, so a malicious payment request can make the wallet or server issue requests to internal hosts. No fix exists yet; disable BIP-70 payment-request handling or filter destination URLs. Details - ------- Summary CVE-2026-111210 (CVSS 3.1 7.3, assigned by VulDB) is a server-side request forgery in the BIP-70 Payment Protocol handler of the bitcoinj Java Bitcoin library. PaymentSession passes the payment_url from a remote PaymentRequest to url.openConnection() with no scheme allowlist and no check for private, loopback or link-local hosts. Setting pki_type to "none" skips the PKI check entirely, and the reporter notes that even a valid x509+sha256 signature does not cover the destination URL. Affected - - bitcoinj up to and including 0.17 (component: Payment Request Handler, PaymentSession.java; the reporter tested 0.11.3 and 0.17 and reviewed 0.12 through 0.16 in source) - - Downstream, the reporter lists bitcoinj-tools (WalletTool, PaymentProtocolTool) and some forks as affected - - No fix available at time of publication. The issue (bitcoinj/bitcoinj#4386, opened 2026-09-29 after a GitHub security advisory got no response) has no maintainer reply or fix PR. Impact A malicious bitcoin: URI with an r= parameter, a QR code, a link or an email can deliver a PaymentRequest that points payment_url at an internal or cloud-metadata address. The signed Payment message, which contains the transactions and refund address, is then sent to the attacker-chosen host, and the response memo is returned to the caller. Non-HTTP schemes such as file: and ftp: are not filtered either. NVD's CVSS vector marks it as needing no user interaction, but the reporter says the victim must confirm the payment. VuDB states that the exploit has been publicly disclosed. This advisory has no confirmation of exploitation in the wild. Recommended actions - - Do not process BIP-70 payment requests (r= URIs) from untrusted sources with bitcoinj, and disable BIP-70 support where it is not required. - - If BIP-70 must stay enabled, enforce https, resolve and pin the destination host, and reject loopback, site-local, link-local, wildcard and multicast addresses before connecting. - - Run services that embed bitcoinj with egress filtering that blocks internal networks and cloud metadata endpoints. - - Watch the bitcoinj issue tracker for a fixed release. Source & attribution This 0xCERT advisory summarises CVE-2026-111210, published by NVD from a VulDB (CNA) record, and the public report by GitHub user NinjaGPT at https://github.com/bitcoinj/bitcoinj/issues/4386. Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://nvd.nist.gov/vuln/detail/CVE-2026-111210 - - CVE-2026-111210 - - https://github.com/bitcoinj/bitcoinj/issues/4386 - - https://github.com/bitcoinj/bitcoinj/security/advisories/GHSA-cqq6-f9cp-chrp - - https://vuldb.com/vuln/420761 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmreJ/EJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmdLFqefL53ljZXlTNKizpk9OY0BJ0fT+uhwgxTt gTfRxRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABhXgD9H7dfb6qBRP3PgxIQ HCLA9Wlggsy0N4X9D/D04KoC64sA/0yQGtMg/+CHLZVd/D/90XkslyZuFbqM pKw13zZhz6UB =3pyA -----END PGP SIGNATURE-----