This vulnerability resides in LangChain’s langchain-openai module. Prior to version 1.1.14 the helper that counts image tokens performs initial SSRF validation on a URL and then fetches the image in a separate network operation with an independent DNS lookup. The separation creates a time‑of‑check to time‑of‑use window; an attacker who supplies a domain that resolves to a public IP during validation can later cause the fetch to resolve to a private or localhost IP, enabling SSRF. The weakness is a classic DNS rebinding flaw (CWE‑918) and a time‑of‑check to time‑of‑use flaw (CWE‑367). The impact is that an attacker can cause the application to make internal network requests that it was not intended to perform.

LangChain – specifically the langchain-openai package – is affected in all releases prior to 1.1.14. The fix was introduced in version 1.1.14 and later releases protect against the DNS rebinding window.

The CVSS score is 3.1, indicating low overall severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw relies on control of a DNS name that can be made to resolve to internal addresses, it is most likely to be exploited by an attacker who can supply image URLs or otherwise invoke the token counting function with a crafted hostname.