CVE-2026-63334
- Source
- https://cve.org/CVERecord?id=CVE-2026-63334
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63334.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-63334
- Aliases
-
- GHSA-3v4h-8r2c-m8c5
- Published
- 2026-09-21T16:22:59Z
- Modified
- 2026-09-23T08:12:43Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- Details
-
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-367", "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63334.json" }- References
-
- https://github.com/jgraph/drawio/releases/tag/v30.2.7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63334.json
- https://github.com/jgraph/drawio/security/advisories/GHSA-3v4h-8r2c-m8c5
- https://nvd.nist.gov/vuln/detail/CVE-2026-63334
- https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e
Affected packages
Git / github.com/jgraph/drawio
Affected versions
v24.*
v24.8.9
v25.*
v25.0.0
v25.0.1
v25.0.2
v26.*
v26.0.0
v26.0.13
v26.0.15
v26.0.16
v26.0.2
v26.0.3
v26.0.4
v26.0.6
v26.0.7
v26.0.9
v26.1.0
v26.1.1
v26.2.15
v26.2.2
v26.2.7
v26.2.8
v27.*
v27.0.2
v27.0.5
v27.0.9
v27.1.6
v28.*
v28.0.1
v28.0.3
v28.0.4
v28.0.5
v28.0.6
v28.0.7
v28.0.9
v28.1.1
v28.1.2
v28.2.0
v28.2.3
v28.2.5
v28.2.7
v28.2.8
v28.2.9
v29.*
v29.0.2
v29.0.3
v29.2.2
v29.2.6
v29.2.7
v29.2.9
v29.3.0
v29.3.2
v29.3.5
v29.3.6
v29.5.1
v29.5.2
v29.6.1
v29.6.10
v29.6.3
v29.6.4
v29.6.5
v29.6.6
v29.6.7
v29.7.11
v29.7.12
v29.7.8
v29.7.9
v30.*
v30.0.0
v30.0.1
v30.0.2
v30.0.4
v30.2.4
v30.2.5
v30.2.6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63334.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "122157432314456716416132773470986001502",
"length": 2169
},
"id": "CVE-2026-63334-1459d441",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/ExportProxyServlet.java",
"function": "doRequest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"327457116756788831173299487039111900215",
"164688692059100785015039194434199670057",
"332965126459094885204648927856353166357",
"121113848624103954163861293995490988782",
"290027269863768349872805321405945468823",
"113282582184320564510899643627247470205",
"252120898774353079211419466597201560472",
"195676515972765324069523193707301522838",
"323708585643746563571220688121069169802",
"264080462300817536752816275490712152474"
],
"threshold": 0.9
},
"id": "CVE-2026-63334-27627005",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/ExportProxyServlet.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "163379010503340273272478343659386302316",
"length": 3614
},
"id": "CVE-2026-63334-3d1adb03",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/ProxyServlet.java",
"function": "doGet"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"326947719102116043339282264473867800708",
"196866477848609522867734090238285106856",
"247217490453466787185543404606187457362",
"285230683787501222990093195530808080183"
],
"threshold": 0.9
},
"id": "CVE-2026-63334-50181816",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/AbsAuth.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209400979065565830071066712018189705087",
"length": 2962
},
"id": "CVE-2026-63334-55a3ce59",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/AbsAuth.java",
"function": "doGetAbst"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "305852350016375733130025532458362885592",
"length": 1762
},
"id": "CVE-2026-63334-6aaba3ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/Utils.java",
"function": "sanitizeUrl"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"317159762213973568379739420242861351150",
"168663015203845778507487901726451042167",
"161645394751257361647124411277918566121",
"145708343217154104668610540811228124332",
"82241248599518277358548532712663249801",
"159387913700128543845619591286850748475",
"297983236862601165162787118241350983496",
"186193578970668427606688622244135015262",
"172920244782605695108031666806456908436",
"306071356158383741543354382934698918453",
"293854028303577201891530015805841585926",
"105730986934091023596023053306833791720",
"109846116817806095433182038249687544734",
"107787256602508023747728129589832826553",
"203524251981473550945815606603841540926",
"39843122122892519316055416575691433603",
"255965932350710100184874032583550416819",
"160107932144677481395532188933310635033",
"68166559904261676621628589390239692358",
"77101914332681458196579645551666146834",
"7032375076291555500170517178483355794",
"266212672478675765895325143785235025792",
"74539218417739477280374857280250617913",
"226186954344917464000379427182526943098",
"278162750807650043894417516342849793389",
"127239443555621968035560975753701331955",
"278233050364974498594668136059406797279",
"281375325885796070321304811323452612393",
"40284922471615852805279477515973305276",
"175940986694096269997003398326063167247",
"264496235805538955116866528331148755078",
"112851938954656266122473692572310685538",
"219644602957139352374878065662187216746",
"228242949476927039145490202593416319301",
"80843182165655156640598690547025988878",
"309106186161109776612685859711348145942",
"319892909989994938184130715676254879520",
"70688350822016584305501734175344091000",
"333074141710635353878506192750459148821",
"8797560133126571071926280780137747383",
"9476403789332508322309529007711544206",
"319892909989994938184130715676254879520",
"240234164841463721700852949395640988246"
],
"threshold": 0.9
},
"id": "CVE-2026-63334-79bac8ad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/Utils.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"27664445827274733551394473119401541234",
"35340166917439562190989250524141456035",
"326950453625813419082222976709843247791",
"272827242286330997712435758673290751530",
"57641700048413085890130369091739686344",
"241633902980954780138587889974626824139",
"213818053637930766713316717007322719655",
"218442341773029257187364401784285824324",
"268867934810338275496551555461804951802",
"336984149401438492358684262764442371087",
"120840367759972752190817814627510980601",
"44836457159922191462268462961104343371",
"29278214259833194622131445997216549994",
"146778911734224262907259815989641432781",
"309760741551824647162879329125442629763",
"174921499553097586657961005825247569255",
"111441549910208477289349099687810878277",
"195071476264363262354543614612736966517",
"321738677148484601219568369999280832618",
"13805072389102795403773337500726279203",
"17176230956501482700822010458088610568",
"246612086413024471123462373435243988521",
"273819605337490961319709625900995378392",
"229045885602182073382037783116765528408",
"49909798454808992225322750622127568051",
"59553265390709309776536132134322492117",
"301694064678297006618548195416723456440"
],
"threshold": 0.9
},
"id": "CVE-2026-63334-9dd94101",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e",
"target": {
"file": "src/main/java/com/mxgraph/online/ProxyServlet.java"
}
}
]
vanir_signatures_modified
"2026-09-23T08:12:43Z"