{"record":{"id":"411684a5fc5cbf61","repo":"BerriAI/litellm","slug":"no-addresses-found-for-hostname","errorCode":null,"errorMessage":"No addresses found for '{hostname}'","messagePattern":"No addresses found for '(.+?)'","errorType":"exception","errorClass":"SSRFError","httpStatus":null,"severity":"error","filePath":"litellm/litellm_core_utils/url_utils.py","lineNumber":285,"sourceCode":"    hostname: Final = parsed.hostname\n    if not hostname:\n        raise SSRFError(\"URL has no hostname\")\n\n    port: Final = parsed.port\n    default_port: Final = _default_port_for_scheme(parsed.scheme)\n    effective_port: Final = port if port is not None else default_port\n    host_header: Final = _format_host_header(hostname, effective_port, default_port)\n\n    is_allowlisted: Final = _is_host_allowlisted(hostname, effective_port)\n\n    # Resolve hostname and validate ALL addresses\n    try:\n        addrinfo: Final = socket.getaddrinfo(hostname, effective_port, proto=socket.IPPROTO_TCP)\n    except socket.gaierror as e:\n        raise SSRFError(f\"DNS resolution failed for '{hostname}': {e}\")\n\n    if not addrinfo:\n        raise SSRFError(f\"No addresses found for '{hostname}'\")\n\n    if not is_allowlisted:\n        for family, type_, proto, canonname, sockaddr in addrinfo:\n            resolved_ip = _sockaddr_host(sockaddr)\n            if _is_blocked_ip(resolved_ip):\n                raise SSRFError(\n                    f\"URL targets a blocked address ({resolved_ip}). \"\n                    \"If this is a legitimate internal service, add the host \"\n                    \"to `user_url_allowed_hosts` in general_settings.\"\n                )\n\n    # For HTTPS with SSL verification enabled, TLS certificate validation\n    # binds the connection to the hostname — DNS rebinding can't redirect\n    # to a different server because the cert wouldn't match.\n    # When SSL verification is disabled, this defense doesn't apply, so\n    # we rewrite to the validated IP like HTTP.\n    ssl_verify: Final = getattr(litellm, \"ssl_verify\", True)\n    if parsed.scheme == \"https\" and ssl_verify is not False:","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/litellm_core_utils/url_utils.py#L267-L303","documentation":"SSRFError raised when getaddrinfo returns success but an empty address list for the hostname — a rare resolver state in which the name yields no usable A/AAAA records at all. The guard exists so the subsequent per-address block check cannot silently skip an empty result.","triggerScenarios":"DNS names whose only records are types getaddrinfo does not return for TCP lookups, misconfigured resolvers, or transient resolver glitches in containers.","commonSituations":"Rare; occasionally seen with broken split-horizon DNS or names that exist in DNS metadata but have no address records.","solutions":["Check what the name actually resolves to from the proxy host: getent ahostsv4 <hostname> or dig A + AAAA.","If there are no address records, fix the DNS entry or change the URL to a name with A/AAAA records.","Retry once — empty answers can be transient — then fail with a clear message."],"exampleFix":"# before\nresp = safe_get(client, user_url)  # SSRFError: No addresses found for 'host'\n\n# after\ntry:\n    resp = safe_get(client, user_url)\nexcept SSRFError as e:\n    if \"No addresses found\" in str(e):\n        raise HTTPException(status_code=400, detail=\"URL host has no resolvable addresses\")\n    raise","handlingStrategy":"try-catch","validationCode":"import socket\n\ndef host_has_addresses(url: str) -> bool:\n    from urllib.parse import urlparse\n    host = urlparse(url).hostname\n    if not host:\n        return False\n    try:\n        return bool(socket.getaddrinfo(host, 443, proto=socket.IPPROTO_TCP))\n    except socket.gaierror:\n        return False","typeGuard":null,"tryCatchPattern":"from litellm.litellm_core_utils.url_utils import SSRFError\n\ntry:\n    resp = safe_get(client, user_url)\nexcept SSRFError as e:\n    if \"No addresses found\" in str(e):\n        raise HTTPException(status_code=400, detail=\"URL host has no resolvable addresses\")\n    raise","preventionTips":["Pre-flight resolve user-supplied hosts with getaddrinfo and reject empty results.","Investigate recurring empty-answer results as a resolver/DNS configuration problem, not client error."],"tags":["ssrf","dns","network","url-validation"],"backgroundTag":"dns-resolution-failure","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}