CVE-2026-107290
mediumPydantic AI is a Python agent framework for building applications and workflows with Generative AI.
Vendor / product: Pydantic — pydantic ai
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-10-08 17:17
Modified: 2026-10-13 14:34
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
pydantic / pydantic_ai ≥1.77.0 <1.107.6, ≥2.0.0 <2.44.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://github.com/pydantic/pydantic-ai/pull/8397
Vendor advisory: https://github.com/pydantic/pydantic-ai/pull/8399
Vendor advisory: https://github.com/pydantic/pydantic-ai/pull/8418
Vendor advisory: https://github.com/pydantic/pydantic-ai/pull/8434
Vendor advisory: https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
Vendor advisory: https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0
Patch / mitigation: https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0
Patch / mitigation: https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b
Patch / mitigation: https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389
Patch / mitigation: https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920
Patch / mitigation: https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1
Patch / mitigation: https://github.com/pydantic/pydantic-ai/pull/8397
Patch / mitigation: https://github.com/pydantic/pydantic-ai/pull/8399
Patch / mitigation: https://github.com/pydantic/pydantic-ai/pull/8418
Patch / mitigation: https://github.com/pydantic/pydantic-ai/pull/8434
Patch / mitigation: https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
References
- https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/pull/8397 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/pull/8399 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/pull/8418 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/pull/84332 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/pull/8434 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0 security-advisories@github.com
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗