CVE-2026-42188
Description
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.
How to fix
- geysermc geyser2.9.3 or later
- org.geysermc.geyser:core2.9.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geysermc geyser | v < 2.9.3 | 2.9.3 |
| org.geysermc.geyser:coreMaven | v < 2.9.3 | 2.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.