🔐 CVE Alert

CVE-2026-107290

MEDIUM 6.5

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.

CWE CWE-1333
Vendor pydantic
Product pydantic-ai
Published Oct 8, 2026
Stay Ahead of the Next One

Get instant alerts for pydantic pydantic-ai

Be the first to know when new medium vulnerabilities affecting pydantic pydantic-ai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected Versions

pydantic / pydantic-ai
>= 1.77.0, < 1.107.6 >= 2.0.0b1, < 2.44.0
pydantic / pydantic-ai-slim
>= 1.77.0, < 1.107.6 >= 2.0.0b1, < 2.44.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp github.com: https://github.com/pydantic/pydantic-ai/pull/8397 github.com: https://github.com/pydantic/pydantic-ai/pull/8399 github.com: https://github.com/pydantic/pydantic-ai/pull/8418 github.com: https://github.com/pydantic/pydantic-ai/pull/84332 github.com: https://github.com/pydantic/pydantic-ai/pull/8434 github.com: https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0 github.com: https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b github.com: https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389 github.com: https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920 github.com: https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1 github.com: https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 github.com: https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0