Cloudanix VulnDB

GHSA-r7w7-9xr2-qq2r

Low · 3.1

langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

CVSS

3.1

EPSS

—

Published

Apr 16, 2026

CISA due date

—

The record

`langchain-openai`'s `_url_to_size()` helper (used by `get_num_tokens_from_messages` for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch. The practical impact is limited because the fetched response body is passed directly to Pillow's `Image.open()` to extract dimensions — the response content is never returned, logged, or otherwise exposed to the caller. An attacker cannot exfiltrate data from internal services through this path. A potential risk is blind probing (inferring whether an internal host/port is open based on timing or error behavior).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities