CVE-2026-107290 · GHSA-fpf4-vwcp-v4hp
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
- Risk score
- 56/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. A…
- Affected
- pydantic-ai (pip) >= 1.77.0, < 1.107.6; pydantic-ai (pip) >= 2.0.0b1, < 2.44.0; pydantic-ai-slim (pip) >= 1.77.0, < 1.107.6; pydantic-ai-slim (pip) >= 2.0.0b1, < 2.44.0
- Fix
- Upgrade pydantic-ai to 1.107.6 or 2.44.0; pydantic-ai-slim to 1.107.6 or 2.44.0 (whichever matches your release line) or later.
- Exploitation
- Public proof of concept
Story map
At a glance
pydantic-ai: Amber, patch this week. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowin…
The flaws
- CVE-2026-107290: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (CVSS 6.5 · EPSS 0%)
- CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (CVSS 7.5 · EPSS 0%)
- CVE-2026-107295: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (CVSS 7.6 · EPSS 0%)
- CVE-2026-107289: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers (CVSS 6.8 · EPSS 0%)
The fix
Upgrade pydantic-ai: 1.107.6 · 2.44.0 · 2.53.0 · 1.107.4 · 2.28.0 or later on your release line
Who is exposed: pydantic-ai (pip) >= 2.10.0, < 2.53.0; pydantic-ai-slim (pip) >= 2.10.0, < 2.53.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-407). 70 other warnings in 30 days
- Same product: Earlier pydantic-ai warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pydantic-ai | pip | >= 1.77.0, < 1.107.6 | 1.107.6 |
| pydantic-ai | pip | >= 2.0.0b1, < 2.44.0 | 2.44.0 |
| pydantic-ai-slim | pip | >= 1.77.0, < 1.107.6 | 1.107.6 |
| pydantic-ai-slim | pip | >= 2.0.0b1, < 2.44.0 | 2.44.0 |
References
- https://github.com/advisories/GHSA-fpf4-vwcp-v4hp
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp
- https://github.com/pydantic/pydantic-ai/pull/8397
- https://github.com/pydantic/pydantic-ai/pull/8399
- https://github.com/pydantic/pydantic-ai/pull/8418
- https://github.com/pydantic/pydantic-ai/pull/8433
- https://github.com/pydantic/pydantic-ai/pull/8434
- https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0
- https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b
- https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389
Original description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.
Last activity 8 Oct 2026. Patch Forecast updates every hour.