EUVD-2026-95093
GHSA-fpf4-vwcp-v4hp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInfluence agent prompt to target URL
-
DeliveryServe crafted page (punycode/unclosed <title>)
-
ExploitAgent fetches via web_fetch_tool
-
ExecutionQuadratic processing blocks event loop
-
ImpactAll coroutines stall, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application using Pydantic AI (pydantic-ai or pydantic-ai-slim, 1.77.0-1.107.5 or 2.0.0b1-2.43.x) that enables the local web_fetch_tool or relies on the WebFetch capability's local fallback, AND an attacker able to make the agent fetch an attacker-controlled URL (in practice via untrusted/injected prompts). The malicious response needs only to be modest in size: a ~1-2 MB body of repeated unterminated <title> tags, long runs of whitespace, or large ordered lists to trigger quadratic CPU, or a Content-Type charset of punycode to block the loop with no HTML at all; unsupported codecs (rot_13, base64_codec) or HTML/JSON nested a few hundred levels deep instead abort the single run. Limiting factors: the vulnerable tool must be enabled and reachable by attacker-influenced input; the pre-existing SSRF protections and download-size limit from GHSA-v2xh-2vp8-57h8 remain in force (they bound bytes downloaded, not processing time); impact is availability only with no data exposure. |
| Impact | This is a genuine but moderate-priority availability issue, not a critical one, and the CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures that: no confidentiality or integrity impact, only availability. The network vector and low complexity are real - a modestly sized (1-2 MB) attacker-controlled page triggers quadratic processing (backtracking title regex, whitespace normalization, ordered-list numbering) or a punycode-labeled body that blocks the event loop for tens of seconds to minutes, stalling every coroutine in the process. PR:L is appropriate because exploitation is not fully unauthenticated in practice: it requires an application that exposes the local web_fetch_tool/WebFetch fallback to untrusted prompts and an attacker able to steer the agent to fetch a hostile URL (typically via prompt injection). No EPSS score, KEV listing, or public exploit code was supplied in the input, so there is no signal of active or widespread exploitation; however, the GHSA advisory documents the technique in enough concrete detail (e.g., ~1 MB charset=punycode body blocking the loop ~30s) that weaponization is low-effort. Net: a real denial-of-service concern for anyone running Pydantic AI agents with web_fetch exposed to untrusted input, but bounded to availability and gated on that specific tool configuration. |
| Exploit ScenarioDerived | An application built on Pydantic AI exposes the local web_fetch_tool to user-supplied prompts. An attacker submits a prompt that steers the agent to fetch a URL they control, serving a ~1-2 MB page of repeated unterminated <title> openings (or a body labeled charset=punycode); processing runs on the event loop and blocks it for minutes, stalling all other agent runs and requests in the process. No public exploit code is identified, but the vendor advisory describes the triggering inputs precisely, making reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
RemediationAI
Vendor-released patches are available: upgrade pydantic-ai and pydantic-ai-slim to 1.107.6 (1.x line) or 2.44.0 (2.x line), per the advisory at https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp and the release pages at https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 and https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0; the fixes land via PRs https://github.com/pydantic/pydantic-ai/pull/8397 and https://github.com/pydantic/pydantic-ai/pull/8399 and their associated commits (2faa6181d8a17d83bc9516d035c5270db8730fa0, 9cdc952e4c3319e85a3e04f2de49fbbb765bd38b, a93ea5226be1e93ae13131ae3f22287190411389, c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920, fb92ccfc3ca2735dab877e2ed73856681bf72ad1), which move HTML parsing/conversion into a worker thread, replace the backtracking title regex with linear scans, and convert deep-nesting and codec failures into a ModelRetry rather than a crash. Where immediate upgrading is not possible, the most effective compensating control is to disable the local web_fetch_tool and the WebFetch local fallback for any agent that can be driven by untrusted or injected prompts, or to route fetching through a separate proxy/fetcher with an independent timeout and concurrency cap - the trade-off being that agents lose web-fetch capability or must rely on the alternate fetcher's fidelity. Note that the SSRF protections and download-size limit from GHSA-v2xh-2vp8-57h8 do not mitigate this bug because they bound bytes downloaded, not CPU time spent processing them, so tightening that limit is not an effective workaround; running the agent process under a hard per-request timeout and isolating agents in dedicated processes or workers limits the blast radius by confining an event-loop stall to one worker at the cost of additional infrastructure and capacity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pydantic AI's local WebFetch implementation downloads a server-supplied response and converts it to markdown for the model, and the vulnerable code path is a textbook CWE-1333 (inefficient regular expression complexity) case compounded by CPU-bound work executing on the event loop. Title extraction used a single backtracking regex ('<title[^>]*>(.*?)</title>' with DOTALL) that, against a body of repeated unterminated '<title' openings, degrades to time proportional to the square of the input size; the HTML-to-markdown conversion had the same quadratic shape in three separate steps - whitespace normalization, preformatted block stripping, and ordered-list numbering - each scaling with a run of spaces or a list's length. Because all of this ran on the event loop, the cost was paid by the whole process rather than a single request, stalling unrelated agent runs and served requests. A second, independent vector came from charset handling: the response body was decoded with whatever codec the server named in the Content-Type 'charset' parameter, looked up in Python's codec registry, which includes 'punycode' (a quadratic-time decoder) and non-text codecs such as 'rot_13' and 'base64_codec' that raise exceptions out of the tool. Finally, markdownify recurses once per nested element, so deeply nested HTML (or JSON nested beyond the interpreter limit) triggers RecursionError and aborts just that run. The affected artifacts are the pydantic-ai and pydantic-ai-slim distributions per the associated CPE entries, and the fix relocates conversion into a worker thread via run_in_executor, replaces the backtracking title regex with two linear literal patterns plus a find('>'), and funnels conversion failures into ModelRetry instead of crashing the run. Per the authoritative assessment, exploitation is limited to availability: no data exposure, and the SSRF protections plus download-size limit from GHSA-v2xh-2vp8-57h8 are unaffected by this issue.
Know when Pydantic Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Remote attacker-controlled response blocks the shared event loop (A:H); PR:L because an agent with web_fetch must be exposed to attacker-influenced prompts; no confidentiality/integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.
Blast Radius
ecosystem impact- 3 pypi packages depend on pydantic-ai (2 direct, 1 indirect)
- 7 pypi packages depend on pydantic-ai-slim (4 direct, 3 indirect)
Ecosystem-wide dependent count for version 1.77.0 and other introduced versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Pydantic Ai
View allPydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functiona
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit whil
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots i
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL int
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML p
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthentica
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets
Exploit-DB