CVE-2026-42188lowCWE-918

CVE-2026-42188: falha de baixa gravidade em GeyserMC Geyser

Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Geyser+ Monitorar org.geysermc.geyser:core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.4epss 0.2%
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
GeyserMC · Geyser
CVEs relacionadas — GeyserMC Geyser

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39177HIGHUser impersonation due to incorrect handling of the login JWTEPSS 1.4%