GHSA-93fv-4pm9-xp28 JDA (Java Discord API) downloads external URLs when updating message components
JDA library allows Server-Side Request Forgery by downloading external URLs from untrusted message components, potentially exposing internal resources or causing DoS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-93fv-4pm9-xp28?
GHSA-93fv-4pm9-xp28 is a server-side request forgery vulnerability in net.dv8tion:JDA, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Anyone using untrusted message components may be affected. On versions >=6.0.0,<6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.
If you are used Message#getComponents or similar to get a list of components and then send those components with sendMessageComponents or other methods, you might unintentionally download media from an external URL in the resolved media of a Thumbnail, FileDisplay, or MediaGallery.
Patches
This bug has been fixed in 6.1.3, and we recommend updating.
Workarounds
Avoid sending components from untrusted messages or update to version 6.1.3.
Which versions are affected by GHSA-93fv-4pm9-xp28?
2 open source packages ship an affected version, including net.dv8tion:JDA.
| Package | Affected | Fixed in |
|---|---|---|
net.dv8tion:JDA Maven | From 6.0.0 | 6.1.3 |
net.dv8tion:JDA Maven | From 6.0.0 | 6.1.3 |
How do I fix GHSA-93fv-4pm9-xp28?
Upgrade net.dv8tion:JDA to 6.1.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-93fv-4pm9-xp28 being exploited?
There is no known exploitation of GHSA-93fv-4pm9-xp28 in the wild and no public exploit code.