← Back

CVE-2026-107290

nvd nist
Published: Oct 8, 2026Modified: Oct 13, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.

Affected (2)

Pydantic
1 product
Pydantic Ai
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Pydantic
Pydantic Ai
From 1.77.0 to 1.107.6
Pydantic Ai
From 2.0.0 to 2.44.0

Related CWEs

CWE-1333
Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (13)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitPatch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Broken Link
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
PatchRelease NotesVendor Advisory
Source: security-advisories@github.com
PatchRelease NotesVendor Advisory
Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.