From fc7718c1829a5ed9edf0aa2ad62c14c965e409ea Mon Sep 17 00:00:00 2001 From: Drishna Trivedi Date: Wed, 20 May 2026 11:57:30 +0530 Subject: [PATCH] fix(aiohttp/ssrf): block IPv6 unspecified address (::) to close wildcard bypass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds ::/128 to _BLOCKED_NETWORKS — the IPv6 unspecified/wildcard address was missing, allowing an attacker to bypass SSRF protection by resolving a hostname to :: which binds to all local interfaces. Co-Authored-By: Claude Sonnet 4.6 --- litellm/llms/custom_httpx/aiohttp_handler.py | 1 + tests/test_litellm/llms/test_aiohttp_ssrf_protection.py | 3 +++ 2 files changed, 4 insertions(+) diff --git a/litellm/llms/custom_httpx/aiohttp_handler.py b/litellm/llms/custom_httpx/aiohttp_handler.py index eae5ae7a6eb..a7bbbf84503 100644 --- a/litellm/llms/custom_httpx/aiohttp_handler.py +++ b/litellm/llms/custom_httpx/aiohttp_handler.py @@ -44,6 +44,7 @@ _BLOCKED_NETWORKS = [ ipaddress.ip_network("169.254.0.0/16"), # Link-local / AWS IMDS ipaddress.ip_network("172.16.0.0/12"), ipaddress.ip_network("192.168.0.0/16"), + ipaddress.ip_network("::/128"), # IPv6 unspecified / wildcard ipaddress.ip_network("::1/128"), ipaddress.ip_network("fc00::/7"), ipaddress.ip_network("fe80::/10"), # IPv6 link-local diff --git a/tests/test_litellm/llms/test_aiohttp_ssrf_protection.py b/tests/test_litellm/llms/test_aiohttp_ssrf_protection.py index 54860ac02ef..c9ef2aa213a 100644 --- a/tests/test_litellm/llms/test_aiohttp_ssrf_protection.py +++ b/tests/test_litellm/llms/test_aiohttp_ssrf_protection.py @@ -26,6 +26,9 @@ class TestBlockedAddress: def test_ipv6_ula_blocked(self): assert _is_blocked_address(ipaddress.ip_address("fc00::1")) + def test_ipv6_unspecified_blocked(self): + assert _is_blocked_address(ipaddress.ip_address("::")) + def test_0_0_0_0_blocked(self): assert _is_blocked_address(ipaddress.ip_address("0.0.0.0"))