Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2026-42188— Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL

CVSS 2.4 · Low EPSS 0.03% · P7

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProductVersion RangeStatus
GeyserMCGeyser< 2.9.3affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-42188

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL
Source: NVD (National Vulnerability Database)
Vulnerability Description
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Geyser 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Geyser是GeyserMC开源的一个跨平台游戏版本桥接代理工具。 Geyser 2.9.3之前版本存在代码问题漏洞，该漏洞源于处理基岩玩家头部纹理数据时存在服务端请求伪造，可能导致攻击者通过/give命令提供特制的Base64编码皮肤纹理URL，使Minecraft服务器向攻击者控制的或内部端点发出任意HTTP GET请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
GeyserMCGeyser < 2.9.3 -

II. Public POCs for CVE-2026-42188

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42188

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Geyser
Same vendor: GeyserMC
Same weakness: CWE-918

V. Comments for CVE-2026-42188

No comments yet

Leave a comment