Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/langchain-openai@0.4.0.dev0
purl pkg:pypi/langchain-openai@0.4.0.dev0
Next non-vulnerable version 1.1.14
Latest non-vulnerable version 1.1.14
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-3mrv-utn3-ffep
Aliases:
CVE-2026-41488
GHSA-r7w7-9xr2-qq2r
PYSEC-2026-76
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
1.1.14
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:24:55.683569+00:00 Pypa Importer Affected by VCID-3mrv-utn3-ffep https://github.com/pypa/advisory-database/blob/main/vulns/langchain-openai/PYSEC-2026-76.yaml 38.6.0