cyfenced.com →

[ CVE-2026-107287 · Published 8 Oct 2026 ]

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

CVSS 6.5 EPSS <1%Fix available

[ Description ]Official description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.

[ Fixes ]Fixes and patches

  • pydantic-ai 1.107.7Fixed version · GitHub Advisories · pip package pydantic-ai: upgrade to 1.107.7 or later (affected >= 1.77.0, < 1.107.7)
  • pydantic-ai 2.52.0Fixed version · GitHub Advisories · pip package pydantic-ai: upgrade to 2.52.0 or later (affected >= 2.0.0b1, < 2.52.0)
  • pydantic-ai-slim 1.107.7Fixed version · GitHub Advisories · pip package pydantic-ai-slim: upgrade to 1.107.7 or later (affected >= 1.77.0, < 1.107.7)
  • pydantic-ai-slim 2.52.0Fixed version · GitHub Advisories · pip package pydantic-ai-slim: upgrade to 2.52.0 or later (affected >= 2.0.0b1, < 2.52.0)
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

[ References ]References