Pydantic AI EUVD-2026-95075

Exploitation requires that the application use Pydantic AI's local web_fetch_tool or the WebFetch local fallback (provider-native web fetching is NOT affected) in an affected version (pydantic-ai / pydantic-ai-slim 1.77.0-<1.107.7, or 2.0.0b1-<2.52.0). The attacker must get the model/agent to fetch an attacker-controlled URL whose response is HTML containing deeply nested block elements (e.g. nested <dd>, <blockquote>, <li>, <div>) that trigger repeated reprocessing during HTML-to-Markdown conversion. Limiting factors: the attack depends on the agent being directed to fetch the malicious URL (UI:R), is confined to availability/resource exhaustion with no data exposure, and is fully nullified by upgrading to 1.107.7 or 2.52.0 or by relying on provider-native fetching.

This is a medium-severity denial-of-service issue (CVSS 6.5, CWE-400) whose signals are largely consistent and point to a real-but-bounded risk rather than a top-tier emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H correctly reflects an unauthenticated (PR:N), low-complexity, availability-only flaw that nonetheless requires interaction (UI:R): an AI agent must be directed by the model to fetch an attacker-controlled URL. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The impact is confined to availability with no confidentiality or integrity loss, and the vendor itself describes the effect as delaying other work in the process (GIL contention / CPU and memory expansion during HTML-to-Markdown conversion) rather than a full crash, so A:H is the conservative upper bound. Mitigating the urgency: the issue only affects the local web_fetch_tool and the WebFetch local fallback - provider-native web fetching is explicitly unaffected - and a vendor patch is already available (1.107.7 and 2.52.0). Overall this is a legitimate hardening priority for anyone running agents that fetch untrusted web content locally, but not a widespread-exploitation emergency. The UI:R requirement plus the availability-only impact mean it is better treated as a resilience/abuse-prevention fix than a critical RCE-class vulnerability.

An attacker publishes a web page containing deeply nested HTML block elements (for example many nested <dd>, <blockquote>, or <li> tags) and gets an AI agent to fetch it - e.g. via a prompt-injection or by seeding a URL the agent is likely to retrieve. When the local web_fetch_tool or WebFetch local fallback converts that HTML to Markdown, the converter repeatedly reprocesses accumulated text and expands a small (~600 KB) page into tens of megabytes, consuming CPU/memory and stalling the process. No public exploit or active exploitation is identified at time of analysis, though the fix PR diffs and conversion-cost benchmarks are public.