CVE-2026-107287: Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Vulnerability summary
CVE-2026-107287 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in pydantic pydantic_ai. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.1% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 08-10-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Pydantic3 products
- pydantic_ai≥ 1.77.0, < 1.107.7 | ≥ 2.0.0, < 2.52.0
- pydantic-ai≥ 1.77.0, < 1.107.7 | ≥ 2.0.0b1, < 2.52.0
- pydantic-ai-slim≥ 1.77.0, < 1.107.7 | ≥ 2.0.0b1, < 2.52.0
PyPI2 products
- pydantic-ai≥ 1.77.0, < 1.107.7 | ≥ 2.0.0b1, < 2.52.0
- pydantic-ai-slim≥ 1.77.0, < 1.107.7 | ≥ 2.0.0b1, < 2.52.0
2 vendors · 5 products
References
12 links- github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cwX Refsource CONFIRMWEBVendor Advisory
- github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180cX Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545X Refsource MISCWEBPatch
- github.com/pydantic/pydantic-ai/releases/tag/v1.107.7X Refsource MISCWEBPatchRelease NotesVendor Advisory
- github.com/pydantic/pydantic-ai/releases/tag/v2.52.0X Refsource MISCWEBPatchRelease NotesVendor Advisory
- pypi.org/project/pydantic-aiPACKAGE
