Vulnerability-Lookup

CVE-2026-107294 (GCVE-0-2026-107294)

Vulnerability from cvelistv5 – Published: 2026-10-08 16:59 – Updated: 2026-10-09 15:15

Title

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Summary

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 20:23 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7628 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/pydantic/pydantic-ai/security/…	x_refsource_CONFIRM
https://github.com/pydantic/pydantic-ai/pull/7141	x_refsource_MISC
https://github.com/pydantic/pydantic-ai/pull/7308	x_refsource_MISC
https://github.com/pydantic/pydantic-ai/commit/7a…	x_refsource_MISC
https://github.com/pydantic/pydantic-ai/commit/e3…	x_refsource_MISC
https://github.com/pydantic/pydantic-ai/releases/…	x_refsource_MISC
https://github.com/pydantic/pydantic-ai/releases/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
pydantic	pydantic-ai	Affected: >= 1.77.0, < 1.107.2 Affected: >= 2.0.0b1, < 2.24.0	guessed
pydantic	pydantic-ai-slim	Affected: >= 1.77.0, < 1.107.2 Affected: >= 2.0.0b1, < 2.24.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107294",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T20:23:19.119515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:15:18.765Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pydantic-ai",
          "vendor": "pydantic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.77.0, \u003c 1.107.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
            }
          ]
        },
        {
          "product": "pydantic-ai-slim",
          "vendor": "pydantic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.77.0, \u003c 1.107.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T16:59:25.246Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/pull/7141",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/pull/7308",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
        },
        {
          "name": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v2xh-2vp8-57h8",
        "discovery": "UNKNOWN"
      },
      "title": "Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107294",
    "datePublished": "2026-10-08T16:59:25.246Z",
    "dateReserved": "2026-10-07T15:53:23.586Z",
    "dateUpdated": "2026-10-09T15:15:18.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107294",
      "date": "2026-10-09",
      "epss": "0.00434",
      "percentile": "0.35726"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "pydantic-ai",
                "vendor": "pydantic",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.77.0, \u003c 1.107.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
                  }
                ]
              },
              {
                "product": "pydantic-ai-slim",
                "vendor": "pydantic",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.77.0, \u003c 1.107.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0."
          }
        ],
        "id": "CVE-2026-107294",
        "lastModified": "2026-10-09T16:17:21.983",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-107294",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T20:23:19.119515Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-08T17:17:15.080",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T23:37:12+00:00",
      "cve": "CVE-2026-107294",
      "id": "CVE-2026-107294",
      "initial_release_date": "2026-10-08T16:59:25.246000+00:00",
      "product_status:known_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "pydantic-ai: pydantic-ai: Denial of Service via unbounded HTTP response buffering",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107294.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-107294",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-08T20:23:19.119515Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-08T20:23:19.737Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "pydantic-ai",
              "vendor": "pydantic",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.77.0, \u003c 1.107.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
                }
              ]
            },
            {
              "product": "pydantic-ai-slim",
              "vendor": "pydantic",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.77.0, \u003c 1.107.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-400",
                  "description": "CWE-400: Uncontrolled Resource Consumption",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-08T16:59:25.246Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/pull/7141",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/pull/7308",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
            },
            {
              "name": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
            }
          ],
          "source": {
            "advisory": "GHSA-v2xh-2vp8-57h8",
            "discovery": "UNKNOWN"
          },
          "title": "Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-107294",
        "datePublished": "2026-10-08T16:59:25.246Z",
        "dateReserved": "2026-10-07T15:53:23.586Z",
        "dateUpdated": "2026-10-09T15:15:18.765Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-OTERM-CVE-2026-107294 (GHSA-V2XH-2VP8-57H8)

Vulnerability from osv_homebrew – Published: 2026-10-08 18:40 – Updated: 2026-10-08 18:40 – Source website

Summary

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Details

Summary

Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool (web_fetch_tool, or the WebFetch capability's local fallback) to untrusted prompts can be driven to fetch an attacker-chosen URL that streams a very large body, exhausting process memory and crashing the worker. The same unbounded buffering applied to FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl).

This is an availability issue only. SSRF protections (scheme allowlist, private-IP and cloud-metadata blocking) are unaffected; there is no confidentiality or integrity impact.

Details

The download helpers read the full response body before applying content-size controls, so an existing text-length limit only truncated after the whole body was already in memory, and media downloads had no wire-level cap at all. A single large response could grow process memory without bound .

Who Is Affected

You are affected if your application registers the local web-fetch tool (or relies on the WebFetch capability's local fallback) and exposes the agent to untrusted prompts, or if it downloads large remote FileUrls influenced by untrusted input. Applications that only fetch developer-controlled URLs are not exposed to the model-chosen attack path.

Remediation

Upgrade to 2.24.0 or later (v2) or 1.107.2 or later (v1). Patched versions enforce a default 50 MiB cap on web-fetch and FileUrl downloads while streaming; pass None to the limit to restore the previous unbounded behavior.

Credits

Identified during internal review of media-download hardening.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/pydantic/pydantic-ai/security/…	WEB
	https://github.com/pydantic/pydantic-ai/pull/7141	WEB
	https://github.com/pydantic/pydantic-ai/pull/7308	WEB
	https://github.com/pydantic/pydantic-ai/commit/7a…	WEB
	https://github.com/pydantic/pydantic-ai/commit/e3…	WEB
	https://github.com/pydantic/pydantic-ai	PACKAGE
	https://github.com/pydantic/pydantic-ai/releases/…	WEB
	https://github.com/pydantic/pydantic-ai/releases/…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "pydantic-ai-slim",
        "resource_purl": "pkg:pypi/pydantic-ai-slim@2.51.0",
        "upstream_fixed_in": "2.24.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "oterm",
        "purl": "pkg:brew/oterm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.15.0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pydantic-ai-slim@2.51.0",
        "name": "pydantic-ai-slim",
        "resource": "pydantic-ai-slim",
        "strategy": "registry",
        "subject_version": "2.51.0"
      }
    ]
  },
  "details": "### Summary\n\nSeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool (`web_fetch_tool`, or the `WebFetch` capability\u0027s local fallback) to untrusted prompts can be driven to fetch an attacker-chosen URL that streams a very large body, exhausting process memory and crashing the worker. The same unbounded buffering applied to `FileUrl` media downloads (`ImageUrl`, `DocumentUrl`, `VideoUrl`, `AudioUrl`).\n\nThis is an **availability** issue only. SSRF protections (scheme allowlist, private-IP and cloud-metadata blocking) are unaffected; there is no confidentiality or integrity impact.\n\n### Details\n\nThe download helpers read the full response body before applying content-size controls, so an existing text-length limit only truncated *after* the whole body was already in memory, and media downloads had no wire-level cap at all. A single large response could grow process memory without bound .\n\n### Who Is Affected\n\nYou are affected if your application registers the local web-fetch tool (or relies on the `WebFetch` capability\u0027s local fallback) and exposes the agent to untrusted prompts, or if it downloads large remote `FileUrl`s influenced by untrusted input. Applications that only fetch developer-controlled URLs are not exposed to the model-chosen attack path.\n\n### Remediation\n\nUpgrade to `2.24.0` or later (v2) or `1.107.2` or later (v1). Patched versions enforce a default 50 MiB cap on web-fetch and `FileUrl` downloads while streaming; pass `None` to the limit to restore the previous unbounded behavior.\n\n### Credits\n\nIdentified during internal review of media-download hardening.",
  "id": "BREW-oterm-CVE-2026-107294",
  "modified": "2026-10-08T18:40:35Z",
  "published": "2026-10-08T18:40:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/pydantic-ai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl",
  "upstream": [
    "GHSA-v2xh-2vp8-57h8",
    "CVE-2026-107294"
  ]
}

FKIE_CVE-2026-107294

Vulnerability from fkie_nvd - Published: 2026-10-08 17:17 - Updated: 2026-10-09 16:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/pull/7141
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/pull/7308
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0
	security-advisories@github.com	https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pydantic-ai",
          "vendor": "pydantic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.77.0, \u003c 1.107.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
            }
          ]
        },
        {
          "product": "pydantic-ai-slim",
          "vendor": "pydantic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.77.0, \u003c 1.107.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0b1, \u003c 2.24.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0."
    }
  ],
  "id": "CVE-2026-107294",
  "lastModified": "2026-10-09T16:17:21.983",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107294",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-08T20:23:19.119515Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-08T17:17:15.080",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V2XH-2VP8-57H8

Vulnerability from github – Published: 2026-10-08 17:16 – Updated: 2026-10-08 17:16

Summary

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Details

Summary

This is an availability issue only. SSRF protections (scheme allowlist, private-IP and cloud-metadata blocking) are unaffected; there is no confidentiality or integrity impact.

Details

Who Is Affected

Remediation

Credits

Identified during internal review of media-download hardening.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.77.0"
            },
            {
              "fixed": "1.107.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.23.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0b1"
            },
            {
              "fixed": "2.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.77.0"
            },
            {
              "fixed": "1.107.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.23.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0b1"
            },
            {
              "fixed": "2.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107294"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:16:28Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nSeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool (`web_fetch_tool`, or the `WebFetch` capability\u0027s local fallback) to untrusted prompts can be driven to fetch an attacker-chosen URL that streams a very large body, exhausting process memory and crashing the worker. The same unbounded buffering applied to `FileUrl` media downloads (`ImageUrl`, `DocumentUrl`, `VideoUrl`, `AudioUrl`).\n\nThis is an **availability** issue only. SSRF protections (scheme allowlist, private-IP and cloud-metadata blocking) are unaffected; there is no confidentiality or integrity impact.\n\n### Details\n\nThe download helpers read the full response body before applying content-size controls, so an existing text-length limit only truncated *after* the whole body was already in memory, and media downloads had no wire-level cap at all. A single large response could grow process memory without bound .\n\n### Who Is Affected\n\nYou are affected if your application registers the local web-fetch tool (or relies on the `WebFetch` capability\u0027s local fallback) and exposes the agent to untrusted prompts, or if it downloads large remote `FileUrl`s influenced by untrusted input. Applications that only fetch developer-controlled URLs are not exposed to the model-chosen attack path.\n\n### Remediation\n\nUpgrade to `2.24.0` or later (v2) or `1.107.2` or later (v1). Patched versions enforce a default 50 MiB cap on web-fetch and `FileUrl` downloads while streaming; pass `None` to the limit to restore the previous unbounded behavior.\n\n### Credits\n\nIdentified during internal review of media-download hardening.",
  "id": "GHSA-v2xh-2vp8-57h8",
  "modified": "2026-10-08T17:16:28Z",
  "published": "2026-10-08T17:16:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/pull/7308"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/pydantic-ai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107294 (GCVE-0-2026-107294)

BREW-OTERM-CVE-2026-107294 (GHSA-V2XH-2VP8-57H8)

Summary

Details

Who Is Affected

Remediation

Credits

FKIE_CVE-2026-107294

GHSA-V2XH-2VP8-57H8

Summary

Details

Who Is Affected

Remediation

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour