CVE-2026-111210 bitcoinj CVE debrief

Who should care

Defenders responsible for systems using bitcoinj, particularly those using versions up to 0.17, should assess their exposure and prioritize verification and potential remediation. This includes operators managing affected deployments, vulnerability management teams, and security teams responsible for ensuring the security of systems that interact with bitcoinj. They should verify their inventory, assess the exposure of their systems, and prioritize remed

Why it matters

This vulnerability in bitcoinj's Payment Request Handler can lead to server-side request forgery, affecting versions up to 0.17. Defenders should verify their inventory, assess exposure, and prioritize remediation based on system criticality.

• Verification of affected bitcoinj versions in inventory is required.
• Exposure assessment for systems using bitcoinj up to 0.17 is necessary.
• Remediation priority should be set based on the criticality of affected systems.

Technical summary

The vulnerability is in the PaymentSession.java file of the bitcoinj component, specifically in the url.openConnection function. Manipulation of the pki_type argument can lead to server-side request forgery. This issue affects bitcoinj up to version 0.17 and can be exploited remotely. The vulnerability allows an attacker to manipulate the pki_type argument, potentially leading to unauthorized actions on the server. Defenders should focus on verifying affected versions in their inventory and assessing system exposure.

Defensive priority

Defenders should prioritize verifying the affected versions of bitcoinj in their inventory and assessing the exposure of their systems to this vulnerability.

Recommended defensive actions

• Verify the version of bitcoinj in use and determine if it is affected (up to 0.17).
• Assess the exposure of systems using bitcoinj to this vulnerability.
• Monitor for any official remediation or patches from the vendor.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence provided includes details from the CVE Program record, NVD vulnerability detail, and various source references. However, the corpus does not establish specific versions beyond 0.17 being affected, nor does it provide details on exploitation or remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.