BerriAI/litellm · error · SSRFError

No addresses found for '{hostname}'

Error message

No addresses found for '{hostname}'

What it means

Raised by litellm's SSRF validator when getaddrinfo returns successfully but with an empty address list for the hostname — a rare result meaning the resolver produced no usable addresses. It fails closed because there is no IP to validate against the SSRF blocklist. Most resolvers raise gaierror instead of returning empty, so seeing this usually indicates a custom/mock resolver or an unusual NSS configuration.

Source

Thrown at litellm/litellm_core_utils/url_utils.py:285

    hostname: Final = parsed.hostname
    if not hostname:
        raise SSRFError("URL has no hostname")

    port: Final = parsed.port
    default_port: Final = _default_port_for_scheme(parsed.scheme)
    effective_port: Final = port if port is not None else default_port
    host_header: Final = _format_host_header(hostname, effective_port, default_port)

    is_allowlisted: Final = _is_host_allowlisted(hostname, effective_port)

    # Resolve hostname and validate ALL addresses
    try:
        addrinfo: Final = socket.getaddrinfo(hostname, effective_port, proto=socket.IPPROTO_TCP)
    except socket.gaierror as e:
        raise SSRFError(f"DNS resolution failed for '{hostname}': {e}")

    if not addrinfo:
        raise SSRFError(f"No addresses found for '{hostname}'")

    if not is_allowlisted:
        for family, type_, proto, canonname, sockaddr in addrinfo:
            resolved_ip = _sockaddr_host(sockaddr)
            if _is_blocked_ip(resolved_ip):
                raise SSRFError(
                    f"URL targets a blocked address ({resolved_ip}). "
                    "If this is a legitimate internal service, add the host "
                    "to `user_url_allowed_hosts` in general_settings."
                )

    # For HTTPS with SSL verification enabled, TLS certificate validation
    # binds the connection to the hostname — DNS rebinding can't redirect
    # to a different server because the cert wouldn't match.
    # When SSL verification is disabled, this defense doesn't apply, so
    # we rewrite to the validated IP like HTTP.
    ssl_verify: Final = getattr(litellm, "ssl_verify", True)
    if parsed.scheme == "https" and ssl_verify is not False:

View on GitHub (pinned to 6c2dcb801b)

Solutions

  1. Run getaddrinfo manually for the host to see the raw result: python -c "import socket; print(socket.getaddrinfo('HOST', 443, proto=socket.IPPROTO_TCP))".
  2. In tests, fix mocks to return at least one (family, type, proto, canonname, (ip, port)) tuple.
  3. Check /etc/hosts and NSS configuration on the host if the empty result reproduces outside tests.

Example fix

# before (test mock returns no addresses)
sock.getaddrinfo = lambda *a, **k: []

# after
sock.getaddrinfo = lambda *a, **k: [(2, 1, 6, '', ('93.184.216.34', 443))]
Defensive patterns

Strategy: try-catch

Validate before calling

import socket

def has_addresses(hostname: str) -> bool:
    try:
        return bool(socket.getaddrinfo(hostname, 443, proto=socket.IPPROTO_TCP))
    except socket.gaierror:
        return False

Try / catch

from litellm.litellm_core_utils.url_utils import SSRFError

try:
    validate_url(url)
except SSRFError as e:
    if "No addresses found" in str(e):
        # resolver env issue, not user input
        log.error("Resolver returned empty answer for %s", url)
    raise

Prevention

When it happens

Trigger: validate_url() on a hostname where getaddrinfo returns [] — e.g. a monkeypatched resolver in tests, an NSS/hosts configuration returning zero entries, or an exotic resolver plugin that yields no records for the name.

Common situations: Test mocks that stub getaddrinfo to return []; hosts-file entries with unusual formatting; alternative resolver libraries injected via sitecustomize; container DNS returning empty answers for certain query types.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/411684a5fc5cbf61. Report an issue: GitHub.