CVE-2026-41488CWE-918

angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

Low · published April 24, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-24T20:57Z
EPSS history
Timeline
  • 24 APR 20:57Z
    angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
    cvelistv5