CVE-2026-41488: angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's urltosize() helper (used by getnumtokensfrommessages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41488?
CVE-2026-41488 has been classified as a medium severity vulnerability due to potential SSRF risks.
How do I fix CVE-2026-41488?
To mitigate CVE-2026-41488, upgrade langchain-openai to version 1.1.14 or later.
What specific component is affected by CVE-2026-41488?
CVE-2026-41488 affects the _url_to_size() helper function within the langchain-openai package.
What attack vector does CVE-2026-41488 expose?
CVE-2026-41488 exposes the system to DNS rebinding attacks that could bypass SSRF protection.
Is the vulnerability CVE-2026-41488 specific to any software version?
Yes, CVE-2026-41488 is applicable to langchain-openai versions prior to 1.1.14.