Pydantic
Monthly
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client contacts to cause severe memory pressure or out-of-memory process termination by returning a crafted compressed response body. The content decoders in `_decoders.py` call `decompress()` without a size cap, so a single 64 KiB compressed chunk can inflate to approximately 64 MiB in one allocation across gzip, deflate, brotli, and zstd encodings - all enabled by default. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept is referenced, but the decompression-bomb technique is well understood and trivially reproducible.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request._prepare() in _models.py appends a Content-Length header even when a caller-supplied Transfer-Encoding header is already present, producing HTTP/1.1 requests with two conflicting framing headers simultaneously. Downstream intermediaries such as reverse proxies or API gateways that resolve the Content-Length vs. Transfer-Encoding ambiguity differently from the upstream server can misparse request boundaries, enabling request smuggling or connection desynchronization affecting co-located sessions. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in v2.11.0.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny service to Python applications using httpx2.Client.sse() or httpx2.AsyncClient.sse() in versions 2.5.0 through 2.9.x. The _SSELineDecoder.decode() method in _sse.py repeatedly copies and rescans its entire in-memory buffer each time a new chunk arrives for an unterminated line, producing O(n²) processing work proportional to the length of the crafted line. A crafted stream can consume excessive CPU, blocking a synchronous worker thread indefinitely or starving an asynchronous event loop. No public exploit identified at time of analysis; a vendor-released patch is available in version 2.10.0.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Symlink traversal in pydantic-settings 2.12.0-2.14.1 allows a local low-privileged attacker with write access to the configured secrets directory to read arbitrary files from the host filesystem into application settings when secrets_nested_subdir=True. The same code path also bypasses the secrets_dir_max_size loading cap, undermining an advertised safety control. No public exploit or CISA KEV listing exists; the vendor-released fix is version 2.14.2.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthenticated attackers to inject arbitrary JavaScript by manipulating the CDN version parameter in a malicious URL. When a victim visits the crafted link, attacker-controlled code executes in their browser, enabling theft of chat history and other sensitive client-side data. No patch is currently available.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pydantic is a data validation and settings management using Python type hinting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client contacts to cause severe memory pressure or out-of-memory process termination by returning a crafted compressed response body. The content decoders in `_decoders.py` call `decompress()` without a size cap, so a single 64 KiB compressed chunk can inflate to approximately 64 MiB in one allocation across gzip, deflate, brotli, and zstd encodings - all enabled by default. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept is referenced, but the decompression-bomb technique is well understood and trivially reproducible.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
HTTP request smuggling in pydantic's HTTPX2 Python client library, all versions prior to 2.11.0, arises because Request._prepare() in _models.py appends a Content-Length header even when a caller-supplied Transfer-Encoding header is already present, producing HTTP/1.1 requests with two conflicting framing headers simultaneously. Downstream intermediaries such as reverse proxies or API gateways that resolve the Content-Length vs. Transfer-Encoding ambiguity differently from the upstream server can misparse request boundaries, enabling request smuggling or connection desynchronization affecting co-located sessions. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in v2.11.0.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Quadratic CPU exhaustion in HTTPX2's Server-Sent Events parser allows a malicious or compromised SSE endpoint to deny service to Python applications using httpx2.Client.sse() or httpx2.AsyncClient.sse() in versions 2.5.0 through 2.9.x. The _SSELineDecoder.decode() method in _sse.py repeatedly copies and rescans its entire in-memory buffer each time a new chunk arrives for an unterminated line, producing O(n²) processing work proportional to the length of the crafted line. A crafted stream can consume excessive CPU, blocking a synchronous worker thread indefinitely or starving an asynchronous event loop. No public exploit identified at time of analysis; a vendor-released patch is available in version 2.10.0.
Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
Symlink traversal in pydantic-settings 2.12.0-2.14.1 allows a local low-privileged attacker with write access to the configured secrets directory to read arbitrary files from the host filesystem into application settings when secrets_nested_subdir=True. The same code path also bypasses the secrets_dir_max_size loading cap, undermining an advertised safety control. No public exploit or CISA KEV listing exists; the vendor-released fix is version 2.14.2.
Server-Side Request Forgery in Pydantic AI (versions 1.56.0-1.101.0, 2.0.0b1, 2.0.0b2) allows unauthenticated network attackers to bypass the cloud-metadata IP blocklist by encoding metadata service addresses (e.g., 169.254.169.254) in IPv6 transition forms - specifically IPv4-compatible IPv6, NAT64 RFC 8215 local-use prefixes, operator-chosen NAT64 prefixes, and ISATAP - that the prior remediation (CVE-2026-46678) failed to decode, enabling retrieval of cloud IAM short-term credentials. Exploitation is constrained by two simultaneous prerequisites: the application must use the non-default `force_download='allow-local'` mode and must operate on a network that routes the affected IPv6 transition forms (e.g., IPv6-only or dual-stack-with-NAT64 Kubernetes clusters). This is the third iteration in an escalating bypass chain (CVE-2026-25580 → CVE-2026-46678 → CVE-2026-48782), and no public exploit has been identified at time of analysis.
Pydantic AI versions 1.34.0 through 1.50.x contain a path traversal vulnerability in the web UI that allows unauthenticated attackers to inject arbitrary JavaScript by manipulating the CDN version parameter in a malicious URL. When a victim visits the crafted link, attacker-controlled code executes in their browser, enabling theft of chat history and other sensitive client-side data. No patch is currently available.
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pydantic is a data validation and settings management using Python type hinting. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.