---
id: CVE-2026-42188
title: >-
  Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java
  Edition
summary: >-
  Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java
  Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability
  exists in Geyser’s handling of Bedrock player head texture data. By supplying
  a crafted…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: geysermc
product: geyser
affected:
  - geyser < 2.9.3
patched:
  - geyser 2.9.3
published: '2026-05-11'
updated: '2026-08-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42188'
references:
  - url: 'https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r'
    label: security-advisories@github.com
  - url: 'https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00281
epssPercentile: 0.18354
ingestedAt: '2026-08-26T13:44:27.320Z'
---

## Overview

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.

## Affected

- `geyser < 2.9.3`

## Remediation

Upgrade past the affected range:

- `geyser 2.9.3`