6.5

CVE-2026-107287

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerpydantic
≫
Produkt pydantic-ai
Version >= 1.77.0, < 1.107.7
Status affected
Version >= 2.0.0b1, < 2.52.0
Status affected
Herstellerpydantic
≫
Produkt pydantic-ai-slim
Version >= 1.77.0, < 1.107.7
Status affected
Version >= 2.0.0b1, < 2.52.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.185
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-407 Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw
https://github.com/pydantic/pydantic-ai/pull/8984
https://github.com/pydantic/pydantic-ai/pull/8985
https://github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180c
https://github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7
https://github.com/pydantic/pydantic-ai/releases/tag/v2.52.0