CVE-2026-107287 · GHSA-v36g-jcw9-x7cw
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested…
- Affected
- pydantic-ai (pip) >= 1.77.0, < 1.107.7; pydantic-ai (pip) >= 2.0.0b1, < 2.52.0; pydantic-ai-slim (pip) >= 1.77.0, < 1.107.7; pydantic-ai-slim (pip) >= 2.0.0b1, < 2.52.0
- Fix
- Upgrade pydantic-ai to 1.107.7 or 2.52.0; pydantic-ai-slim to 1.107.7 or 2.52.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
pydantic-ai: Amber, patch this week. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowin…
The flaws
- CVE-2026-107287: Pydantic AI: Excessive resource use when local web fetching converts nested HTML (CVSS 6.5 · EPSS 0%)
- CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (CVSS 7.5 · EPSS 0%)
- CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (CVSS 7.6 · EPSS 0%)
- CVE-2026-107290: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (CVSS 6.5 · EPSS 0%)
The fix
Upgrade pydantic-ai: 1.107.7 · 2.52.0 · 2.53.0 · 1.107.4 · 2.28.0 · 1.107.6 or later on your release line
Who is exposed: pydantic-ai (pip) >= 2.10.0, < 2.53.0; pydantic-ai-slim (pip) >= 2.10.0, < 2.53.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
- Same product: Earlier pydantic-ai warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pydantic-ai | pip | >= 1.77.0, < 1.107.7 | 1.107.7 |
| pydantic-ai | pip | >= 2.0.0b1, < 2.52.0 | 2.52.0 |
| pydantic-ai-slim | pip | >= 1.77.0, < 1.107.7 | 1.107.7 |
| pydantic-ai-slim | pip | >= 2.0.0b1, < 2.52.0 | 2.52.0 |
References
- https://github.com/advisories/GHSA-v36g-jcw9-x7cw
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw
- https://github.com/pydantic/pydantic-ai/pull/8984
- https://github.com/pydantic/pydantic-ai/pull/8985
- https://github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180c
- https://github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.52.0
- https://github.com/advisories/GHSA-v36g-jcw9-x7cw
Original description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.