CVE-2026-107290

Description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.

Traduire en français

Produits concernés

• pydantic-ai
• pydantic-ai-slim
• Pydantic pydantic ai

Scores CVSS

Faiblesses (CWE)

• CWE-1333

Références

• https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0 Patch
• https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b Patch
• https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389 Patch
• https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920 ExploitPatch
• https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1 Patch
• https://github.com/pydantic/pydantic-ai/pull/8397 PatchVendor Advisory
• https://github.com/pydantic/pydantic-ai/pull/8399 PatchVendor Advisory
• https://github.com/pydantic/pydantic-ai/pull/8418 PatchVendor Advisory
• https://github.com/pydantic/pydantic-ai/pull/84332 Broken Link
• https://github.com/pydantic/pydantic-ai/pull/8434 PatchVendor Advisory
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 PatchRelease NotesVendor Advisory
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0 PatchRelease NotesVendor Advisory
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories