Gemini CLI fixes SSRF vulnerability with enhanced DNS validation and SNI preservation
diegogodinezr · ghdev · 2026-08-29
This PR enhances security in WebFetchTool by improving destination address validation and connection routing. Key changes include asynchronous DNS resolution with validation of all returned IPs, filtering private or reserved ranges (e.g., RFC 1918, loopback), and implementing transport layer connection pinning via Undici to bind directly to resolved IPs. It preserves TLS SNI to ensure proper HTTPS handshakes and adopts a fail-closed approach to prevent DNS rebinding or SSRF attacks.
More from Infra
- Google expands Android Earthquake Alerts from 98 to nearly 200 countries after 1B+ alerts — sundarpichai · 2026-10-16
- Microsoft's Magnetar zkVM proves programs 10-39x faster using only standard hash functions — Microsoft Research · 2026-10-16
- Moving 1PB back on-premises costs a fortune as AI training drives cloud repatriation — DavidLinthicum · 2026-10-15
- FP8 + DSpark stack delivers ~2x speedup for Nemotron 3.5 Super VL on H100s — vllm_project · 2026-10-15
- Nemotron 3.5 Super VL hits ~630 tokens/s at 100k-token prompts, fastest 20+ score model measured — ArtificialAnlys · 2026-10-15
- vLLM Ships Day-0 Support for Nemotron 3.5 Super VL with NVFP4 on a Single GB200 — vllm_project · 2026-10-15