A function in bitcoinj’s PaymentSession.java (url.openConnection) fails to properly validate the pki_type argument, enabling an attacker to cause the library to open arbitrary outbound connections. This server‑side request forgery can let a remote actor fetch internal or external resources, potentially leaking sensitive data, accessing privileged services, or facilitating further attacks such as credential theft or denial‑of‑service against internal hosts. The CVSS score of 6.9 reflects a moderate risk, as the vulnerability requires control over input but leads to tangible impact on confidentiality and integrity.

The issue affects the bitcoinj open‑source library up to and including version 0.17. Applications that incorporate bitcoinj’s Payment Request Handler and rely on the url.openConnection call in PaymentSession.java are impacted. The vulnerability is specific to the mentioned component and would apply to any Java project importing the affected bitcoinj releases without patching or updating the library.

Exploitation is possible remotely through crafted Payment Session requests that specify a malicious pki_type value. The exploit has been disclosed publicly and the project has not yet released an official patch, meaning that attackers could identify vulnerable deployments using the known public URLs and send SSRF‑triggering payloads. The EPSS score of 0.00291 indicates a very low probability of exploitation, but the lack of a fix combined with the public disclosure suggests that the vulnerability is likely to be acted upon. The vulnerability is not listed in the CISA KEV catalog, yet the potential for unauthorized external network access remains a significant concern.