CVE-2026-107294

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Uncontrolled Resource Consumption pada pydantic ai. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0 patch · release notes · advisory vendor
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8 advisory vendor
• https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d patch
• https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8 patch
• https://github.com/pydantic/pydantic-ai/pull/7141 patch · issue tracking
• https://github.com/pydantic/pydantic-ai/pull/7308 patch · issue tracking
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2 patch · release notes