Approved changes feed: RSS · Atom
cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Geysermc (1a96003c-0b19-5c9c-af45-7bb09336f795) |
|---|---|
| Product | Geyser (4b64316b-c672-5bd5-86aa-e335443c092f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/geysermc/geyser |
purl2cpe | 2026-06-01 10:12:43.967797 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42188 |
vulnerable | 2026-06-08 08:03:15.982322 |
Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL
LOW (2.4)
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.
Published: 2026-05-11T21:25:27.303Z
Updated: 2026-05-13T14:39:09.024Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39177 |
vulnerable | 2026-06-08 05:33:49.095059 |
User impersonation due to incorrect handling of the login JWT
HIGH (7.4)
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any user. Version 1.4.2-SNAPSHOT contains a patch for the issue. There are no known workarounds aside from upgrading.
Published: 2021-08-30T23:00:12.000Z
Updated: 2024-08-04T01:58:18.223Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.