GHSA-r7w7-9xr2-qq2r

Suggest an improvement
Source
https://github.com/advisories/GHSA-r7w7-9xr2-qq2r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r7w7-9xr2-qq2r/GHSA-r7w7-9xr2-qq2r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-r7w7-9xr2-qq2r
Aliases
Downstream
Published
2026-04-16T23:00:12Z
Modified
2026-06-06T01:15:08.805674014Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
Details

Summary

langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.

The practical impact is limited because the fetched response body is passed directly to Pillow's Image.open() to extract dimensions — the response content is never returned, logged, or otherwise exposed to the caller. An attacker cannot exfiltrate data from internal services through this path. A potential risk is blind probing (inferring whether an internal host/port is open based on timing or error behavior).

Affected versions

  • langchain-openai < 1.1.14

Patched versions

  • langchain-openai >= 1.1.14 (requires langchain-core >= 1.2.31)

Affected code

File: libs/partners/openai/langchain_openai/chat_models/base.py — _url_to_size()

The vulnerable pattern was a validate-then-fetch with separate DNS resolution:

validate_safe_url(image_source, allow_private=False, allow_http=True)
# ... separate network operation with independent DNS resolution ...
response = httpx.get(image_source, timeout=timeout)

Fix

The fix replaces the validate-then-fetch pattern with an SSRF-safe httpx transport (SSRFSafeSyncTransport from langchain-core) that:

  • Resolves DNS once and validates all returned IPs against a policy (private ranges, cloud metadata, localhost, k8s internal DNS)
  • Pins the connection to the validated IP, eliminating the DNS rebinding window
  • Disables redirect following to prevent redirect-based SSRF bypasses

This fix was released in langchain-openai 1.1.14.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2026-04-24T21:16:19Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "LOW",
    "github_reviewed_at": "2026-04-16T23:00:12Z"
}
References

Affected packages

PyPI / langchain-openai

Package

Name
langchain-openai
View open source insights on deps.dev
Purl
pkg:pypi/langchain-openai

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.14

Affected versions

0.*
0.0.1rc0
0.0.1rc1
0.0.1
0.0.2
0.0.2.post1
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8rc1
0.0.8
0.1.0
0.1.1
0.1.2
0.1.3rc1
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8rc1
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.19
0.1.20
0.1.21rc1
0.1.21rc2
0.1.21
0.1.22
0.1.23
0.1.24
0.1.25
0.2.0.dev0
0.2.0.dev1
0.2.0.dev2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4rc1
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9rc1
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27
0.3.28
0.3.29
0.3.30
0.3.31
0.3.32
0.3.33
0.3.34
0.3.35
0.4.0.dev0
1.*
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r7w7-9xr2-qq2r/GHSA-r7w7-9xr2-qq2r.json"