CVE-2026-107290 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python-based framework designed to facilitate the development of applications and workflows leveraging Generative Artificial Intelligence agents. Within this ecosystem, tools such as web_fetch_tool are critical for enabling agents to retrieve and process external data from the internet. However, versions ranging from 1.77.0 up to but not including 1.108.0, specifically those ending at 1.107.6 in the legacy branch and below version 2.44.0 in the newer series, contain a significant implementation flaw within their local web fetching mechanisms. This vulnerability affects both the primary fetch tool and its fallback process server-controlled responses, exposing the application to resource exhaustion attacks through inefficient text processing algorithms.
The core technical flaw lies in how these components handle title extraction, whitespace normalization, and ordered-list numbering from fetched HTML or JSON content. The implementation utilizes quadratic time complexity operations for parsing titles and normalizing whitespace. In computer science terms, a quadratic algorithm means that the execution time grows proportionally to the square of the input size. Consequently, while small pages process quickly, even modestly sized attacker-controlled web pages can trigger disproportionately long processing times. This inefficiency causes the application's event loop to block for an extended period. Since Python applications often rely on asynchronous event loops to handle multiple concurrent tasks, blocking this loop effectively stalls all other agent runs and pending requests within that instance, leading to a denial of service condition where legitimate users cannot interact with the system.
Beyond simple performance degradation, the vulnerability also encompasses issues related to unsupported codecs and excessive nesting depth in HTML or JSON structures. When an attacker provides content encoded in formats not supported by the parser, or constructs deeply nested data structures, the processing logic may fail abruptly rather than handling the error gracefully. This results in the abortion of individual agent runs, further contributing to service instability and unreliability for end-users relying on continuous AI-driven workflows. These failure modes highlight a lack of robust input validation and resource limits within the parsing routines, allowing malicious inputs to disrupt normal operational flow.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-756, Missing Mandatory Protection Step, due to the absence of safeguards against inefficient algorithms and malformed input handling. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1496, Host-Based Denial of Service, where an attacker leverages specific application logic flaws to exhaust system resources or disrupt service availability without necessarily crashing the entire server process immediately but rather by degrading performance through computational exhaustion.
To mitigate this vulnerability, organizations must upgrade Pydantic AI to version 1.108.0 or later for the legacy branch and version 2.44.0 or later for the current series. These releases address the quadratic complexity issues in title extraction and whitespace normalization, ensuring that processing time scales linearly with input size rather than quadratically. Additionally, developers should implement strict rate limiting on web fetch requests to prevent any single request from monopolizing resources even if other mitigations are applied. It is also advisable to configure timeouts for external HTTP calls and parsing operations to ensure that no single operation can block the event loop indefinitely. By adhering to these version requirements and implementing defensive coding practices, teams can maintain the availability and responsiveness of their Generative AI applications against such resource exhaustion attacks.