{"record":{"id":"8d6aca4ae5c99018","repo":"langchain-ai/langchain","slug":"network-error-while-validating-url-e","errorCode":null,"errorMessage":"Network error while validating URL: {e}","messagePattern":"Network error while validating URL: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"libs/core/langchain_core/_security/_ssrf_protection.py","lineNumber":105,"sourceCode":"            hostname,\n            parsed.port or (443 if parsed.scheme == \"https\" else 80),\n            socket.AF_UNSPEC,\n            socket.SOCK_STREAM,\n        )\n\n        for result in addr_info:\n            ip_str: str = result[4][0]  # type: ignore[assignment]\n            try:\n                _validate_resolved_ip(ip_str, policy)\n            except SSRFBlockedError as exc:\n                raise ValueError(str(exc)) from exc\n\n    except socket.gaierror as e:\n        msg = f\"Failed to resolve hostname '{hostname}': {e}\"\n        raise ValueError(msg) from e\n    except OSError as e:\n        msg = f\"Network error while validating URL: {e}\"\n        raise ValueError(msg) from e\n\n    return url_str\n\n\ndef is_safe_url(\n    url: str | AnyHttpUrl,\n    *,\n    allow_private: bool = False,\n    allow_http: bool = True,\n) -> bool:\n    \"\"\"Non-throwing version of `validate_safe_url`.\"\"\"\n    try:\n        validate_safe_url(url, allow_private=allow_private, allow_http=allow_http)\n    except ValueError:\n        return False\n    else:\n        return True\n","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/langchain-ai/langchain/blob/e32fa9a52eab3b61ad7a45399bfde59b3e580fc4/libs/core/langchain_core/_security/_ssrf_protection.py#L87-L123","documentation":"While running `validate_safe_url`, a generic `OSError` (not a name-resolution `gaierror`) escaped the DNS-resolution step and was re-raised as `ValueError('Network error while validating URL: ...')`. This is an environment-level failure of `socket.getaddrinfo` — typically resolver unreachable, temporary failure in name resolution, or a socket-level resource problem — not a policy rejection.","triggerScenarios":"`validate_safe_url(url)` when the system resolver is temporarily unavailable (e.g. 'Temporary failure in name resolution', EAI_AGAIN), DNS server timeouts, exhausted file descriptors affecting socket creation, or sandboxed environments blocking socket syscalls.","commonSituations":"Containers with flaky/unreachable DNS; AWS/ECS/K8s DNS pod failures; rate-limited resolvers (EAI_AGAIN under load); restrictive seccomp/sandbox profiles blocking `getaddrinfo`.","solutions":["Retry the validation after a short delay — EAI_AGAIN-style failures are often transient","Inspect the embedded OS error text to distinguish 'resolver unreachable' from 'name unknown' and fix DNS config accordingly","Point the process at a healthy resolver (set `nameserver` in /etc/resolv.conf, k8s DNS diagnostics) or a public resolver like 8.8.8.8 if policy allows","If validation runs in a sandbox that forbids sockets, run SSRF validation outside the sandbox or against precomputed IPs"],"exampleFix":"# before\nurl = validate_safe_url(target)\n\n# after\nfor attempt in range(3):\n    try:\n        url = validate_safe_url(target)\n        break\n    except ValueError as e:\n        if attempt == 2 or not str(e).startswith(\"Network error\"):\n            raise\n        time.sleep(2 ** attempt)","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"last: ValueError | None = None\nfor attempt in range(3):\n    try:\n        url = validate_safe_url(target)\n        break\n    except ValueError as e:\n        if not str(e).startswith('Network error'):\n            raise\n        last, delay = e, 2 ** attempt\n        time.sleep(delay)\nelse:\n    raise RuntimeError(f'SSRF validation kept failing: {last}')","preventionTips":["Treat 'Network error while validating URL' as transient first; only escalate after retries","Monitor resolver health (EAI_AGAIN rates) in the deployment","Do not disable SSRF validation to 'fix' DNS flakiness — fix DNS instead"],"tags":["ssrf","dns","network","transient","validation"],"backgroundTag":null,"analyzedSha":"e32fa9a52eab3b61ad7a45399bfde59b3e580fc4","analyzedAt":"2026-08-14T18:42:09.092Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}