CVE-2026-107290

Katalog CVE

CVSS 6.5 · Medium EPSS 0,42%

Kerentanan Inefficient Regular Expression Complexity pada pydantic ai. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydantic/pydantic-ai/pull/8397 patch · advisory vendor
• https://github.com/pydantic/pydantic-ai/pull/8399 patch · advisory vendor
• https://github.com/pydantic/pydantic-ai/pull/8418 patch · advisory vendor
• https://github.com/pydantic/pydantic-ai/pull/8434 patch · advisory vendor
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6 patch · release notes · advisory vendor
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0 patch · release notes · advisory vendor
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp advisory vendor
• https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0 patch
• https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b patch
• https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389 patch
• https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920 exploit · patch
• https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1 patch
• https://github.com/pydantic/pydantic-ai/pull/84332 broken link