Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M
CVE-2026-41488angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
Low 3.1
In plain English
A low-severity server-side request forgery in langchain-openai from langchain-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langchain-openai | 1.1.14 | GHSA-r7w7-9xr2-qq2r |
| PyPI | langchain-openai | 1.1.14 | PYSEC-2026-76 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langchain-ai | langchain-openai | < 1.1.14 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N