CVE-2026-111210 affects the bitcoinj Java library up to version 0.17, specifically its Payment Request Handler component. By tampering with the pki_type argument passed to PaymentSession.java's connection-opening function, a remote attacker can trigger a server-side request forgery condition without authentication. A working exploit is already public, and the maintainers reportedly have not yet responded to an earlier bug report about the flaw.
// source: nvd.nist.gov ↗