langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebindingGHSA-r7w7-9xr2-qq2r
LOWGHSA-r7w7-9xr2-qq2r is a low-severity (CVSS 3.1) Server-Side Request Forgery (SSRF) vulnerability in langchain-openai. A fix is available for langchain-openai — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-r7w7-9xr2-qq2r.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
langchain-openaiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
The practical impact is limited because the fetched response body is passed directly to Pillow's Image.open() to extract dimensions — the response content is never returned, logged, or otherwise exposed to the caller. An attacker cannot exfiltrate data from internal services through this path. A potential risk is blind probing (inferring whether an internal host/port is open based on timing or error behavior).
Affected versions
langchain-openai< 1.1.14
Patched versions
langchain-openai>= 1.1.14 (requireslangchain-core>= 1.2.31)
Affected code
File: libs/partners/openai/langchain_openai/chat_models/base.py — _url_to_size()
The vulnerable pattern was a validate-then-fetch with separate DNS resolution:
validate_safe_url(image_source, allow_private=False, allow_http=True)
# ... separate network operation with independent DNS resolution ...
response = httpx.get(image_source, timeout=timeout)
Fix
The fix replaces the validate-then-fetch pattern with an SSRF-safe httpx transport (SSRFSafeSyncTransport from langchain-core) that:
- Resolves DNS once and validates all returned IPs against a policy (private ranges, cloud metadata, localhost, k8s internal DNS)
- Pins the connection to the validated IP, eliminating the DNS rebinding window
- Disables redirect following to prevent redirect-based SSRF bypasses
This fix was released in langchain-openai 1.1.14.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | langchain-openai | all versions | 1.1.14pip install --upgrade 'langchain-openai==1.1.14' |
Affected Products
langchain-openailangchainDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langchain-openai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update langchain-openai to 1.1.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r7w7-9xr2-qq2r is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability has a Low impact on Red Hat products. The flaw in `langchain-openai` allows a remote attacker to bypass Server-Side Request Forgery (SSRF) protection through a DNS rebinding attack. This is due to a Time-of-Check to Time-of-Use (TOCTOU) vulnerability during URL validation and fetching, which could…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.Source: Red Hat security advisory for GHSA-r7w7-9xr2-qq2r (CC BY 4.0)
Frequently Asked Questions
Is GHSA-r7w7-9xr2-qq2r in your dependencies?
Find it across PyPI, including transitive dependencies.