CVE-2026-107287
- Source
- https://cve.org/CVERecord?id=CVE-2026-107287
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107287.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107287
- Aliases
- Downstream
- Published
- 2026-10-08T15:15:05Z
- Modified
- 2026-10-28T02:31:13Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Pydantic AI: Excessive resource use when local web fetching converts nested HTML
- Details
-
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400", "CWE-407" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107287.json" }- References
-
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.52.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107287.json
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw
- https://nvd.nist.gov/vuln/detail/CVE-2026-107287
- https://github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180c
- https://github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545
- https://github.com/pydantic/pydantic-ai/pull/8984
- https://github.com/pydantic/pydantic-ai/pull/8985
Affected packages
Git / github.com/pydantic/pydantic-ai
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pydantic/pydantic-ai
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:pydantic:pydantic_ai:*:*:*:*:*:python:*:*", "range": [ { "introduced": "1.77.0" }, { "fixed": "1.107.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:pydantic:pydantic_ai:*:-:*:*:*:python:*:*", "range": [ { "introduced": "2.0.0" }, { "fixed": "2.52.0" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "2b247add4950bef61d352e7ca8aefbd20539180c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "2fd38792693da00a3ca5412aeffb436787af3545" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.107.7", "range": [ { "fixed": "2fd38792693da00a3ca5412aeffb436787af3545" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v2.52.0", "range": [ { "fixed": "4de1ee3cf6026caa7f58b293ae929a1130b6b388" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v1.*
v1.100.0
v1.101.0
v1.102.0
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.107.0
v1.107.1
v1.107.2
v1.107.4
v1.107.5
v1.107.6
v1.77.0
v1.78.0
v1.79.0
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.84.1
v1.85.0
v1.85.1
v1.86.0
v1.86.1
v1.87.0
v1.88.0
v1.89.0
v1.89.1
v1.90.0
v1.91.0
v1.92.0
v1.93.0
v1.94.0
v1.95.0
v1.95.1
v1.96.0
v1.96.1
v1.97.0
v1.98.0
v1.99.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.27.1
v2.28.0
v2.29.0
v2.3.0
v2.30.0
v2.31.0
v2.31.1
v2.32.0
v2.32.1
v2.32.2
v2.33.0
v2.34.0
v2.35.0
v2.35.1
v2.35.3
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.5.0
v2.5.1
v2.50.0
v2.51.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v2.9.1