{"id":"CVE-2026-63334","summary":"draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist","details":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.","aliases":["GHSA-3v4h-8r2c-m8c5"],"modified":"2026-09-23T08:12:43.816025Z","published":"2026-09-21T16:22:59.708Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-367","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63334.json"},"references":[{"type":"WEB","url":"https://github.com/jgraph/drawio/releases/tag/v30.2.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63334.json"},{"type":"ADVISORY","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-3v4h-8r2c-m8c5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63334"},{"type":"FIX","url":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jgraph/drawio","events":[{"introduced":"0"},{"fixed":"650fbd742814f6502f78248dc2d8e2aaa5e42b5e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"30.2.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v30.2.6","v30.2.5","v30.2.4","v30.0.4","v30.0.2","v30.0.1","v30.0.0","v29.7.12","v29.7.11","v29.7.9","v29.7.8","v29.6.10","v29.6.7","v29.6.6","v29.6.5","v29.6.4","v29.6.3","v29.6.1","v29.5.2","v29.5.1","v29.3.6","v29.3.5","v29.3.2","v29.3.0","v29.2.9","v29.2.7","v29.2.6","v29.2.2","v29.0.3","v29.0.2","v28.2.9","v28.2.8","v28.2.7","v28.2.5","v28.2.3","v28.2.0","v28.1.2","v28.1.1","v28.0.9","v28.0.7","v28.0.6","v28.0.5","v28.0.4","v28.0.3","v28.0.1","v27.1.6","v27.0.9","v27.0.5","v27.0.2","v26.2.15","v26.2.8","v26.2.7","v26.2.2","v26.1.1","v26.1.0","v26.0.16","v26.0.15","v26.0.13","v26.0.9","v26.0.7","v26.0.6","v26.0.4","v26.0.3","v26.0.2","v26.0.0","v25.0.2","v25.0.1","v25.0.0","v24.8.9"],"database_specific":{"vanir_signatures_modified":"2026-09-23T08:12:43Z","vanir_signatures":[{"id":"CVE-2026-63334-1459d441","signature_type":"Function","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/ExportProxyServlet.java","function":"doRequest"},"deprecated":false,"digest":{"function_hash":"122157432314456716416132773470986001502","length":2169}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/ExportProxyServlet.java"},"deprecated":false,"digest":{"line_hashes":["327457116756788831173299487039111900215","164688692059100785015039194434199670057","332965126459094885204648927856353166357","121113848624103954163861293995490988782","290027269863768349872805321405945468823","113282582184320564510899643627247470205","252120898774353079211419466597201560472","195676515972765324069523193707301522838","323708585643746563571220688121069169802","264080462300817536752816275490712152474"],"threshold":0.9},"id":"CVE-2026-63334-27627005"},{"source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/ProxyServlet.java","function":"doGet"},"deprecated":false,"digest":{"function_hash":"163379010503340273272478343659386302316","length":3614},"id":"CVE-2026-63334-3d1adb03","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/com/mxgraph/online/AbsAuth.java"},"deprecated":false,"digest":{"line_hashes":["326947719102116043339282264473867800708","196866477848609522867734090238285106856","247217490453466787185543404606187457362","285230683787501222990093195530808080183"],"threshold":0.9},"id":"CVE-2026-63334-50181816","signature_type":"Line","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e"},{"source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/AbsAuth.java","function":"doGetAbst"},"deprecated":false,"digest":{"function_hash":"209400979065565830071066712018189705087","length":2962},"id":"CVE-2026-63334-55a3ce59","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63334-6aaba3ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/Utils.java","function":"sanitizeUrl"},"deprecated":false,"digest":{"function_hash":"305852350016375733130025532458362885592","length":1762}},{"signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/Utils.java"},"deprecated":false,"digest":{"line_hashes":["317159762213973568379739420242861351150","168663015203845778507487901726451042167","161645394751257361647124411277918566121","145708343217154104668610540811228124332","82241248599518277358548532712663249801","159387913700128543845619591286850748475","297983236862601165162787118241350983496","186193578970668427606688622244135015262","172920244782605695108031666806456908436","306071356158383741543354382934698918453","293854028303577201891530015805841585926","105730986934091023596023053306833791720","109846116817806095433182038249687544734","107787256602508023747728129589832826553","203524251981473550945815606603841540926","39843122122892519316055416575691433603","255965932350710100184874032583550416819","160107932144677481395532188933310635033","68166559904261676621628589390239692358","77101914332681458196579645551666146834","7032375076291555500170517178483355794","266212672478675765895325143785235025792","74539218417739477280374857280250617913","226186954344917464000379427182526943098","278162750807650043894417516342849793389","127239443555621968035560975753701331955","278233050364974498594668136059406797279","281375325885796070321304811323452612393","40284922471615852805279477515973305276","175940986694096269997003398326063167247","264496235805538955116866528331148755078","112851938954656266122473692572310685538","219644602957139352374878065662187216746","228242949476927039145490202593416319301","80843182165655156640598690547025988878","309106186161109776612685859711348145942","319892909989994938184130715676254879520","70688350822016584305501734175344091000","333074141710635353878506192750459148821","8797560133126571071926280780137747383","9476403789332508322309529007711544206","319892909989994938184130715676254879520","240234164841463721700852949395640988246"],"threshold":0.9},"id":"CVE-2026-63334-79bac8ad","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["27664445827274733551394473119401541234","35340166917439562190989250524141456035","326950453625813419082222976709843247791","272827242286330997712435758673290751530","57641700048413085890130369091739686344","241633902980954780138587889974626824139","213818053637930766713316717007322719655","218442341773029257187364401784285824324","268867934810338275496551555461804951802","336984149401438492358684262764442371087","120840367759972752190817814627510980601","44836457159922191462268462961104343371","29278214259833194622131445997216549994","146778911734224262907259815989641432781","309760741551824647162879329125442629763","174921499553097586657961005825247569255","111441549910208477289349099687810878277","195071476264363262354543614612736966517","321738677148484601219568369999280832618","13805072389102795403773337500726279203","17176230956501482700822010458088610568","246612086413024471123462373435243988521","273819605337490961319709625900995378392","229045885602182073382037783116765528408","49909798454808992225322750622127568051","59553265390709309776536132134322492117","301694064678297006618548195416723456440"],"threshold":0.9},"id":"CVE-2026-63334-9dd94101","signature_type":"Line","signature_version":"v1","source":"https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e","target":{"file":"src/main/java/com/mxgraph/online/ProxyServlet.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63334.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}