Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.geysermc.geyser:core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.4MavenPublished

    Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

    CVE-2026-42188 · GHSA-xcfg-fcr5-gw9r

    Affected
    • Maven org.geysermc.geyser:core <= 2.9.2
    Fixed in
    2.9.3· Vendor fix available
    Issue
    A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. Details Geyser allows Bedrock clients to interact with Java Edition mechanics, including the creation of custom player heads using the minecraft:profile NBT structure. When a player head is created with a custom textures property, Geyser processes the Base64-encoded JSON value and forwards the embedded texture URL for resolution. However, the URL contained in the textures.SKIN.url field is not sufficiently validated. PoC 1. Setup Environment: - Set up a Minecraft Server (Paper/Spigot) with the latest version of Geyser installed. - Ensure you have a Bedrock client…

    Recommended action: Upgrade to 2.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →