EUVD-2026-95104
GHSA-v2xh-2vp8-57h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit prompt referencing attacker URL
-
DeliveryAgent invokes web_fetch/FileUrl download
-
ExploitServer streams oversized response body
-
ExecutionFull body buffered before size check
-
ImpactProcess memory exhausted, worker crashes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when the application registers the local web_fetch_tool or relies on the WebFetch capability's local fallback, OR downloads remote FileUrl media (ImageUrl, DocumentUrl, VideoUrl, AudioUrl), AND the fetched URL can be influenced by untrusted input (e.g. an agent exposed to untrusted prompts). Running an affected version (>=1.77.0 <1.107.2, or >=2.0.0b1 <=2.23.0) is required. Key limiting factors: applications that fetch only developer-controlled URLs are NOT exposed; the pre-patch default had no effective cap, but patched versions enforce a 50 MiB download limit unless explicitly set to None. Attacker must control (or redirect to) a server willing to stream an arbitrarily large body. |
| Impact | This is a moderate-severity availability-only flaw (CWE-400 resource exhaustion) in Pydantic AI, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) correctly reflects a network-reachable, low-complexity attack with no confidentiality or integrity impact - only worker crash via memory exhaustion. There is no CISA KEV listing and no EPSS score provided, and the advisory itself states the issue was found during internal review with no evidence of exploitation, so this is 'no public exploit identified at time of analysis.' The real-world priority is tempered by a hard deployment precondition: the vulnerability is only reachable if the application registers the local web_fetch_tool / WebFetch local fallback (or downloads untrusted FileUrl media) AND exposes the agent to untrusted prompt input - applications fetching only developer-controlled URLs are not exposed. Note a tagging discrepancy: the input is tagged 'SSRF', but the description and GHSA advisory explicitly state SSRF protections (scheme allowlist, private-IP and metadata blocking) remain effective and the impact is availability only - do not treat this as an SSRF/data-exfiltration issue. Net: a legitimate patch-worthy DoS for anyone running agents on untrusted input, but not an emergency given availability-only impact, no confirmed exploitation, and the configuration/exposure prerequisites. |
| Exploit ScenarioDerived | An application exposes a Pydantic AI agent with the web_fetch_tool (or WebFetch local fallback) to untrusted end-user prompts. A user crafts a prompt that induces the model to fetch an attacker-controlled URL whose server streams a multi-gigabyte response body; because the download path buffers the entire body before applying size limits, process memory is exhausted and the worker crashes. The same effect is achievable by supplying an oversized ImageUrl/DocumentUrl/VideoUrl/AudioUrl FileUrl. No public exploit code is identified, but the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying any size limit in its remote-content download paths, so an attacker-chosen URL can stream an arbitrarily large body that exhausts process memory and crashes the worker. Affected components are the local web_fetch_tool, the WebFetch capability's local fallback, and remote FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl); the issue affects versions from 1.77.0 to before 1.107.2 on the v1 line and 2.0.0b1 through 2.23.0 on the v2 line. This is an availability-only flaw (CWE-400) - SSRF protections remain effective and there is no confidentiality or integrity impact - and no public exploit identified at time of analysis, though exploitation requires only that the application register the local web-fetch tool and expose the agent to untrusted prompts (or download untrusted-input-influenced FileUrls) while running an affected version.
RemediationAI
Vendor-released patch: upgrade pydantic-ai and pydantic-ai-slim to 1.107.2 or later on the v1 line, or to 2.24.0 or later on the v2 line (advisory: https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8; fixes landed via PRs https://github.com/pydantic/pydantic-ai/pull/7141 and https://github.com/pydantic/pydantic-ai/pull/7308, commits 7a64d049c3f5271a975cd1d64b2fa876d83ede1d and e3824a58c82864ed26afb2887619834a4eb86cc8, releases v1.107.2 and v2.24.0). Patched versions enforce a default 50 MiB streaming download cap and a 50,000-character content cap; do not pass None to max_download_bytes or max_content_length in production, and instead tighten max_download_bytes below the default if your workloads legitimately fetch smaller payloads - the trade-off is that responses larger than the configured cap fail fast with a download-exceeds error instead of being truncated, which can break legitimate large-document or long-audio fetches. If upgrading immediately is not possible, the highest-value compensating control is to stop registering the local web_fetch_tool and to avoid relying on the WebFetch capability's local fallback in any agent that consumes untrusted prompts, and to restrict agent-supplied FileUrl downloads to a fixed allowlist of developer-controlled hosts; the cost is loss of model-initiated web fetch and remote media functionality. Additionally, force egress through a proxy that enforces a hard response-size limit and returns only identity/gzip encodings (mirroring the patch's _BOUNDED_ACCEPT_ENCODING behavior so Brotli/Zstandard/deflate responses are refused upstream), and run agent workers under a cgroup/container memory limit with supervised restart so a large body kills a single worker rather than the host - the trade-off being added operational complexity and possible worker restarts under legitimate load. Note that SSRF controls are unaffected and do not mitigate this issue, so blocking private IP ranges does not reduce exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-400 (Uncontrolled Resource Consumption): the download helpers performed a fully buffered httpx GET, reading the entire response body into memory, and only afterwards enforced content-size controls. Consequently the pre-existing text-length limit merely truncated an already-buffered body, and the FileUrl media paths had no wire-level cap at all, so a single large response could grow process memory without bound. The authoritative assessment rates this as network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - the attacker does not need credentials, only the ability to influence the URL that a model-driven or untrusted-prompt-driven fetch will retrieve - and the impact is confined to availability. The upstream fix converts the download path to a streamed request (client.send(..., stream=True), aiter_raw) and enforces the byte cap while data is arriving rather than after the fact, including gzip decompression bounded with zlib's output max_length so a highly compressible payload cannot expand past the limit mid-decode. The patch also restricts the negotiated encodings to Accept-Encoding: identity, gzip, deliberately excluding Brotli and Zstandard (a few compressed bytes can expand into multi-MiB output in one decoder step) and deflate (which must be buffered whole to distinguish zlib-wrapped from raw framing); servers that nonetheless return those codings are rejected. A default cap of 50 MiB (max_download_bytes) is applied to web-fetch and FileUrl downloads, with a separate 50,000-character max_content_length for returned text. The associated tags (Denial Of Service, Python, SSRF) reflect the delivery context - a URL fetch - but the advisory is explicit that scheme allowlisting and private-IP/cloud-metadata blocking are unaffected, so the SSRF tag should not be read as an SSRF bypass.
Know when Pydantic Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable via untrusted prompts with no attacker privileges (PR:N) and low complexity; availability-only worker crash (A:H), with the tool-exposure requirement treated as a deployment precondition rather than privilege or complexity.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.
Blast Radius
ecosystem impact- 3 pypi packages depend on pydantic-ai (2 direct, 1 indirect)
- 7 pypi packages depend on pydantic-ai-slim (4 direct, 3 indirect)
Ecosystem-wide dependent count for version 1.77.0 and other introduced versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Pydantic Ai
View allPydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functiona
Cross-site request forgery in Pydantic AI's development web chat UI allows any website a developer happens to visit whil
Concurrency slot exhaustion in Pydantic AI 2.10.0 through 2.52.x lets streamed model requests permanently occupy slots i
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network at
Server-side request forgery in Pydantic AI's URL-fetching guards lets an application that has explicitly opted a URL int
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unaut
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML p
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdap
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthentica
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets
Exploit-DB