Gemini CLI fixes SSRF vulnerability with enhanced DNS validation and SNI preservation
diegogodinezr · ghdev · 2026-08-29
This PR enhances security in WebFetchTool by improving destination address validation and connection routing. Key changes include asynchronous DNS resolution with validation of all returned IPs, filtering private or reserved ranges (e.g., RFC 1918, loopback), and implementing transport layer connection pinning via Undici to bind directly to resolved IPs. It preserves TLS SNI to ensure proper HTTPS handshakes and adopts a fail-closed approach to prevent DNS rebinding or SSRF attacks.
More from Infra
- Jensen Huang joins BG2 podcast: does AI revenue justify capex, '27 bottlenecks — elonmusk · 2026-10-16
- Mistral's on-device infra rack revealed: DGX Spark, Mac Studio and more — gregmushen · 2026-10-16
- NVIDIA and Sweden's Wallenberg launch Sferical One, a shared AI supercomputer — nvidia · 2026-10-16
- Next infra frontier: self-evolving systems that adapt and self-verify — _shreya_s · 2026-10-16
- Xiaomi's MiMo RL dashboard reveals $3.47M spent on just 30 training steps — bycloud · 2026-10-16
- Cerebras pushes disaggregated inference: heterogeneous prefill pools feeding wafer-scale decode — ai · 2026-10-16