PYSEC-2026-76
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/langchain-openai/PYSEC-2026-76.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-76
- Aliases
- Published
- 2026-04-24T21:16:19Z
- Modified
- 2026-05-20T09:19:04Z
- Severity
-
- 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
- References
Affected packages
PyPI / langchain-openai
Package
- Name
- langchain-openai
- View open source insights on deps.dev
- Purl
- pkg:pypi/langchain-openai
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.1.14
Affected versions
0.*
0.0.1rc0
0.0.1rc1
0.0.1
0.0.2
0.0.2.post1
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8rc1
0.0.8
0.1.0
0.1.1
0.1.2
0.1.3rc1
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8rc1
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.19
0.1.20
0.1.21rc1
0.1.21rc2
0.1.21
0.1.22
0.1.23
0.1.24
0.1.25
0.2.0.dev0
0.2.0.dev1
0.2.0.dev2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4rc1
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9rc1
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27
0.3.28
0.3.29
0.3.30
0.3.31
0.3.32
0.3.33
0.3.34
0.3.35
0.4.0.dev0
1.*
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13