8 views
-/https://github.com/berriai/litellm/issues/33410
GitHub · issue

#33410 Upgrade yarl for URL parser security fix

  • State: open
  • Author: @mielverkerken
  • Labels: potential-duplicate

LiteLLM currently locks `yarl==1.23.0` in `uv.lock`

The Aikido advisory `AIKIDO-2026-10912` reports `yarl` versions `0.0.1` through `1.23.0` as affected by URL parser host confusion issues that can enable SSRF-style validation bypasses when applications compare parsed URL fields with serialized URL strings

The advisory lists `1.24.0` as the fixed release. Because `yarl` 1.24.0 and 1.24.1 had PyPI publishing issues, the dependency should be upgraded to `1.24.2` or newer so LiteLLM no longer resolves an affected parser version

Relevant upstream release notes: https://github.com/aio-libs/yarl/releases/tag/v1.24.0

https://intel.aikido.dev/cve/AIKIDO-2026-10912

Open on GitHub

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d17h53m39s ago — entered · #import:https:::github.com:berriai:litellm post #2972
-/https://github.com/berriai/litellm/issues/2773610:1-/https://github.com/berriai/litellm/issues/33410⭐
The proxy fix requires distributed state consistency, synchronization semantics, race-condition handling, and multi-replica testing, while the other is primarily a dependency-resolution and lockfile update.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search