CVE-2026-107287 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python agent framework designed for constructing applications and workflows that integrate with Generative AI systems. Within this ecosystem, the local web_fetch_tool and its associated WebFetch local fallback mechanism are critical components responsible for retrieving external content from URLs to provide context or data to language models. A significant vulnerability exists in versions ranging from 1.77.0 up to but not including 1.107.7, as well as version 2.52.0 prior to its patching update. This flaw specifically impacts the internal process of converting HTML content into Markdown format when processing user-controlled or attacker-supplied input. The vulnerability stems from an inefficient algorithmic approach used during this conversion phase, which fails to properly manage memory and computational resources when encountering complex document structures.
The technical core of this issue lies in how the framework handles deeply nested block elements within HTML documents. When the parser encounters such structures, it engages in a repetitive reprocessing cycle that accumulates text data without efficient pruning or bounded growth controls until specific thresholds are reached. This behavior results in an exponential expansion of intermediate output buffers, leading to excessive consumption of both Central Processing Unit cycles and Random Access Memory. The algorithm essentially enters a state where it repeatedly processes previously accumulated content rather than moving forward with the conversion stream efficiently. This inefficiency is not present when using provider-native web fetching mechanisms, indicating that the flaw is isolated strictly to the local fallback implementation used by Pydantic AI for internal processing tasks.
From an operational perspective, this vulnerability poses a severe risk of Denial of Service against applications utilizing affected versions of Pydantic AI. An attacker who can influence the content fetched via the web_fetch_tool could craft malicious HTML payloads containing deeply nested tags to trigger this resource exhaustion behavior. By doing so, they can cause the agent process to consume disproportionate amounts of system resources, effectively delaying or halting other concurrent workloads within the same environment. This capability allows for a model-directed fetch attack where the AI itself might be manipulated into requesting specific malicious URLs, thereby initiating the denial-of-service condition autonomously without direct external intervention at the moment of execution.
This vulnerability aligns with Common Weakness Enumeration category CWE-400, which describes Uncontrolled Resource Consumption, as well as aspects of CWE-755 related to Improper Handling of Unexpected or Excessive Input Length. In terms of the MITRE ATT&CK framework, this exploit vector corresponds to techniques involving resource exhaustion attacks that aim to degrade service availability rather than compromise data confidentiality or integrity directly. The impact is primarily on system stability and performance reliability, potentially leading to application crashes or significant latency in response times for legitimate users relying on the AI agent services.
Mitigation strategies require immediate upgrading of the Pydantic AI library to version 1.107.7 or later, which includes patches addressing this inefficient parsing logic. For environments where an upgrade is not immediately feasible, administrators should consider implementing strict input validation and size limits on any HTML content passed through the web_fetch_tool before it reaches the conversion engine. Additionally, deploying resource monitoring tools to detect abnormal spikes in CPU and memory usage associated with specific processes can help identify such attacks early. It is also advisable to restrict the scope of URLs that agents are permitted to fetch from, reducing the attack surface available for crafting malicious payloads. Ensuring that fallback mechanisms are hardened against malformed or excessively complex inputs remains a critical best practice in securing generative AI applications.