CVE-2026-41488: 
Python vulnerability analysis and mitigation

CVE-2026-41488 is a Server-Side Request Forgery (SSRF) vulnerability in LangChain's langchain-openai package, specifically in the _url_to_size() helper function used by get_num_tokens_from_messages for image token counting. The flaw arises from a Time-of-Check-Time-of-Use (TOCTOU) / DNS rebinding race condition where URL validation and the subsequent fetch operation use independent DNS resolutions. All versions of langchain-openai prior to 1.1.14 are affected. It was published on April 24, 2026, with a patch released in the same timeframe. The CVSS v3.1 base score is 3.1 (Low) (GitHub Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The vulnerable code in libs/partners/openai/langchain_openai/chat_models/base.py follows a validate-then-fetch pattern: validate_safe_url() is called first to block private/localhost IPs, but the subsequent httpx.get() call performs an independent DNS resolution, creating a DNS rebinding window. An attacker who controls a hostname can configure it to resolve to a legitimate public IP during validation and then switch the DNS response to a private or internal IP (e.g., 127.0.0.1, 192.168.x.x, or cloud metadata endpoints) before the actual fetch occurs. Exploitation requires user interaction (e.g., a user or application passing an attacker-controlled image URL to the token-counting function) (GitHub Advisory).

The practical impact of this vulnerability is limited: the fetched response body is passed directly to Pillow's Image.open() to extract image dimensions, and the response content is never returned, logged, or exposed to the caller. As a result, an attacker cannot directly exfiltrate data from internal services through this path. The primary risk is blind SSRF probing — an attacker may infer whether an internal host or port is open based on timing differences or error behavior, potentially enabling internal network reconnaissance (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.028%, reflecting a very low probability of exploitation in the near term. The vulnerability requires high attack complexity (successful DNS rebinding timing) and user interaction, further limiting practical exploitability. No threat actor attribution or CISA KEV catalog listing has been identified (GitHub Advisory).

1. Set up a malicious DNS server: Configure an attacker-controlled domain (e.g., attacker.example.com) with a DNS server that initially returns a legitimate public IP address with a very short TTL (e.g., 1 second).
2. Craft a malicious image URL: Prepare a URL pointing to the attacker-controlled hostname (e.g., http://attacker.example.com/image.png) that will be passed to the vulnerable get_num_tokens_from_messages function as an image source.
3. Trigger URL validation: Cause the target LangChain application to process the crafted URL — during validate_safe_url(), the hostname resolves to the public IP and passes the SSRF check.
4. Switch DNS resolution: Immediately after validation, update the DNS record for attacker.example.com to resolve to a private/internal IP (e.g., 169.254.169.254 for AWS metadata, 127.0.0.1, or an internal service IP).
5. Exploit the fetch: When httpx.get() performs its independent DNS resolution, it now resolves to the internal IP and fetches the internal resource. The response is passed to Pillow, enabling blind probing of internal hosts/ports based on timing or error behavior (GitHub Advisory).

• Network: Outbound HTTP requests from the application server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1) or cloud metadata endpoints (e.g., 169.254.169.254) originating from the LangChain/Python process.
• Network: Repeated DNS lookups for the same hostname in rapid succession (indicative of DNS rebinding attempts), especially with very short TTLs.
• Logs: Application error logs showing Pillow Image.open() failures or unexpected HTTP response codes when processing image URLs from external sources.
• Network: HTTP GET requests to unusual internal endpoints or ports that would not normally be accessed by the application, particularly from the service account running the LangChain application.

The fix is available in langchain-openai version 1.1.14 (which also requires langchain-core >= 1.2.31). The patched version replaces the validate-then-fetch pattern with an SSRF-safe httpx transport (SSRFSafeSyncTransport from langchain-core) that resolves DNS once, validates all returned IPs against a policy covering private ranges, cloud metadata endpoints, localhost, and Kubernetes internal DNS, and pins the connection to the validated IP to eliminate the rebinding window. Redirect following is also disabled to prevent redirect-based SSRF bypasses. As a network-level workaround, restrict outbound connections from application servers to private IP ranges and consider implementing DNS pinning (GitHub Advisory).