tinyhumansai/openhuman · error

DNS rebinding blocked: '{host}' resolved to private/local ad

Error message

DNS rebinding blocked: '{host}' resolved to private/local address {ip_str}

What it means

DNS rebinding defense: the hostname passed the textual checks, but at least one resolved IP is private or local, meaning the domain could be a rebinding front for internal infrastructure; every such resolution causes the whole request to be blocked.

Source

Thrown at src/openhuman/tools/impl/network/url_guard.rs:140

    if host.parse::<std::net::IpAddr>().is_ok() {
        return Ok(url);
    }

    let port = extract_port(&url)?;
    log::debug!("[url_guard] resolving DNS for host={host} port={port}");
    let addrs = resolver(host.clone(), port).await?;

    if addrs.is_empty() {
        anyhow::bail!("DNS resolution returned no addresses for '{host}'");
    }

    log::debug!("[url_guard] DNS resolved host={host} addrs={}", addrs.len());

    for addr in &addrs {
        let ip_str = addr.to_string();
        if is_private_or_local_host(&ip_str) {
            log::debug!("[url_guard] DNS rebinding blocked host={host} resolved_ip={ip_str}");
            anyhow::bail!(
                "DNS rebinding blocked: '{host}' resolved to private/local address {ip_str}"
            );
        }
    }

    Ok(url)
}

async fn resolve_host_ips(host: String, port: u16) -> anyhow::Result<Vec<IpAddr>> {
    let log_host = host.clone();
    tokio::task::spawn_blocking(move || {
        (host.as_str(), port)
            .to_socket_addrs()
            .map_err(|e| {
                log::debug!("[url_guard] DNS resolution failed host={host} port={port} error={e}");
                anyhow::anyhow!("DNS resolution failed for '{host}': {e}")
            })
            .map(|iter| iter.map(|addr| addr.ip()).collect())

View on GitHub (pinned to 7491200858)

Solutions

1. Use a host whose DNS records point only at public addresses
2. If this is your own domain, remove private/local A or AAAA records from it
3. Do not attempt to reach internal services through http_request

When it happens

Trigger: Thrown at src/openhuman/tools/impl/network/url_guard.rs:140 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/c6702ace9f358805. Report an issue: GitHub.