fix(aiohttp): block private/metadata IPs in api_base to close SSRF gap from PR #26264 (CWE-918) - #28246

Closed

DrishnaTrivedi wants to merge 3 commits into

BerriAI:litellm_internal_stagingfrom

DrishnaTrivedi:fix/aiohttp-ssrf-private-ip-block

Commits on May 19, 2026

fix(aiohttp): block private/metadata IPs in api_base — close SSRF gap from #26264 (CWE-918)

DrishnaTrivedi
and
claude
committed
7939c33
fix(aiohttp): harden SSRF guard — all DNS answers, sync path, redirect block, IPv4-mapped IPv6, fe80+0.0.0.0

DrishnaTrivedi
and
claude
committed
42fbc91
fix(aiohttp): add SSRFGuardResolver to close DNS-rebinding TOCTOU and restore redirects

DrishnaTrivedi
and
claude
committed
730fe02