{"action":"Upgrade org.geysermc.geyser:core to 2.9.3 or later.","affected":[{"fixed":"2.9.3","introduced":"0"}],"component":"org.geysermc.geyser:core","cve_ids":["CVE-2026-42188"],"ecosystem":"Maven","epss":0.00195,"exploited":false,"fixed_versions":["2.9.3"],"ghsa_id":"GHSA-xcfg-fcr5-gw9r","id":"tcs_01M5N9J4SQKBFGFECBK5TV1KCY","modified_at":"2026-05-13T14:33:38.616935Z","published_at":"2026-05-05T20:03:16Z","references":["https://osv.dev/vulnerability/GHSA-xcfg-fcr5-gw9r","https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r","https://nvd.nist.gov/vuln/detail/CVE-2026-42188","https://github.com/GeyserMC/Geyser"],"severity":{"label":"low","score":2.4},"sources":[{"source":"osv","source_id":"GHSA-xcfg-fcr5-gw9r","url":"https://osv.dev/vulnerability/GHSA-xcfg-fcr5-gw9r"}],"summary":"Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser"}