Fedora
CVE-2024-3772
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 32 pypi packages depend on pydantic (32 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
DescriptionNVD
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
AnalysisAI
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-1333. Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. Affected products include: Pydantic, Fedoraproject Fedora.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functiona
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebS
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client c
Pydantic is a data validation and settings management using Python type hinting. Rated high severity (CVSS 7.5), this vu
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny se
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthentica
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today