Read the docs
TI-2026-69616 Aliases CVE-2026-107287GHSA-v36g-jcw9-x7cw

Excessive resource use in Pydantic AI HTML-to-Markdown web fetching

Priority LOW 29CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The Pydantic AI packages pydantic-ai and pydantic-ai-slim from 1.77.0 before 1.107.7 and from 2.0.0b1 before 2.52.0 are affected. The local web_fetch_tool and WebFetch fallback repeatedly reprocess accumulated text during HTML-to-Markdown conversion, which is an inefficient algorithm (CWE-407). An attacker who controls fetched HTML with deeply nested block elements can use a model-directed fetch to consume excessive CPU and memory and delay other work in the process. Provider-native web fetching is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Partial pydantic-ai (pydantic): 1.107.7, 2.52.0pydantic-ai-slim (pydantic): 1.107.7, 2.52.0+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pydanticpydantic-ai1.77.0 to before 1.107.7; 2.0.0b1 to before 2.52.01.107.7, 2.52.0Patch availableCNA
pydanticpydantic-ai-slim1.77.0 to before 1.107.7; 2.0.0b1 to before 2.52.01.107.7, 2.52.0Patch availableCNA
—pydantic-ai (PyPI)1.77.0 to before 1.107.71.107.7Patch availableGHSA-v36g-jcw9-x7cw
—pydantic-ai (PyPI)2.0.0b1 to before 2.52.02.52.0Patch availableGHSA-v36g-jcw9-x7cw
—pydantic-ai-slim (PyPI)1.77.0 to before 1.107.71.107.7Patch availableGHSA-v36g-jcw9-x7cw
—pydantic-ai-slim (PyPI)2.0.0b1 to before 2.52.02.52.0Patch availableGHSA-v36g-jcw9-x7cw
  • pydantic-ai Vendorpydantic Affected 1.77.0 to before 1.107.7; 2.0.0b1 to before 2.52.0 Fixed in 1.107.7, 2.52.0 Patch available CNA
  • pydantic-ai-slim Vendorpydantic Affected 1.77.0 to before 1.107.7; 2.0.0b1 to before 2.52.0 Fixed in 1.107.7, 2.52.0 Patch available CNA
  • pydantic-ai (PyPI) Vendor— Affected 1.77.0 to before 1.107.7 Fixed in 1.107.7 Patch available GHSA-v36g-jcw9-x7cw
  • pydantic-ai (PyPI) Vendor— Affected 2.0.0b1 to before 2.52.0 Fixed in 2.52.0 Patch available GHSA-v36g-jcw9-x7cw
  • pydantic-ai-slim (PyPI) Vendor— Affected 1.77.0 to before 1.107.7 Fixed in 1.107.7 Patch available GHSA-v36g-jcw9-x7cw
  • pydantic-ai-slim (PyPI) Vendor— Affected 2.0.0b1 to before 2.52.0 Fixed in 2.52.0 Patch available GHSA-v36g-jcw9-x7cw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*1.77.0 to before 1.107.7Vulnerablepydantic
cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*2.0.0 to before 2.52.0Vulnerablepydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:* Versions 1.77.0 to before 1.107.7 Vulnerable ·pydantic
  • cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:* Versions 2.0.0 to before 2.52.0 Vulnerable ·pydantic

Remediation

Upgrade pydantic-ai and pydantic-ai-slim to 1.107.7 on the 1.x line or to 2.52.0 on the 2.x line. Red Hat's plan for Lightspeed Core and Red Hat Enterprise Linux AI (RHEL AI) 3 is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pydantic-ai (pydantic) Fixed in 1.107.7, 2.52.0
  • Fix · CNA pydantic-ai-slim (pydantic) Fixed in 1.107.7, 2.52.0
  • Fix · GHSA-v36g-jcw9-x7cw pydantic-ai (PyPI) Fixed in 1.107.7 Advisory →
  • Fix · GHSA-v36g-jcw9-x7cw pydantic-ai (PyPI) Fixed in 2.52.0 Advisory →
  • Fix · GHSA-v36g-jcw9-x7cw pydantic-ai-slim (PyPI) Fixed in 1.107.7 Advisory →
  • Fix · GHSA-v36g-jcw9-x7cw pydantic-ai-slim (PyPI) Fixed in 2.52.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107287
  2. 2026-10-08 Alias added: GHSA-v36g-jcw9-x7cw
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-09 CVSS score added · Red Hat
  5. 2026-10-10 Priority changed: MEDIUM → LOW
  6. 2026-10-14 CISA SSVC decision points changed

References

Patch 6

Advisory 1

Other 1

  • TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
  • TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
  • TI-2026-46990 Incorrect authorization in pydantic-ai CVSS 3.1MEDIUM 6.5
  • TI-2026-69610 Cross-site requests run agent tools in pydantic-ai web chat CVSS 3.1HIGH 7.6
  • TI-2026-20740 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL CVSS 3.1HIGH 7.1
  • TI-2026-69617 Pydantic AI blocklist bypass via IPv6 zone identifier allows SSRF CVSS 3.1MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences