CVE-2026-107294 in Pydantic
Summary
by MITRE • 10/08/2026
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
Pydantic AI serves as a Python agent framework designed for constructing applications and workflows utilizing Generative Artificial Intelligence capabilities. Within this ecosystem, the web_fetch_tool functions as a critical component for retrieving external data sources, including local fallbacks via WebFetch and remote media downloads such as ImageUrl, DocumentUrl, VideoUrl, and AudioUrl entities. A significant vulnerability exists in versions ranging from 1.77.0 up to 1.107.2, as well as version 2.24.0 prior to its patching release. The core technical flaw lies in the memory management strategy employed during HTTP response processing. Specifically, these affected implementations buffer the entire HTTP response body into process memory before applying content-size controls or limits. This architectural decision creates a scenario where the system attempts to load potentially massive data streams entirely into RAM without intermediate streaming checks that would enforce size constraints earlier in the pipeline.
The operational impact of this design flaw is primarily centered on availability rather than confidentiality or integrity, as Server-Side Request Forgery protections remain effective and prevent unauthorized access to internal network resources. However, an attacker who can influence the URL targeted by these media download functions can exploit this behavior by providing a link that returns an arbitrarily large HTTP response body. When the Pydantic AI agent processes such a request, it attempts to buffer the complete payload in memory. This action rapidly exhausts available process memory, leading to out-of-memory conditions that cause the worker process to crash or become unresponsive. In production environments where these agents operate as part of larger services, this can result in service degradation, denial of service for other users sharing the same resources, and increased operational costs due to resource exhaustion.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting through memory exhaustion. The attack vector leverages the application's trust in external URLs without sufficient validation of payload size prior to allocation, reflecting weaknesses often associated with improper input handling and resource management practices. While not a direct code execution or data leakage issue, it represents a critical availability risk that can be triggered remotely by any actor capable of providing maliciously crafted URLs to the agent framework. The vulnerability is effectively mitigated in versions 1.107.2 and later for the legacy branch, as well as version 2.24.0 and subsequent releases for the current major version line. These updates likely implement streaming mechanisms or pre-fetch size checks that enforce content limits before full buffering occurs, thereby preventing memory exhaustion attacks while maintaining functionality for legitimate media downloads.