359 matches found
PYSEC-2026-4276 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...
PYSEC-2026-4285 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...
PYSEC-2026-4288 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...
PYSEC-2026-4280 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fet...
PYSEC-2026-4278 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...
PYSEC-2026-4279 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...
PYSEC-2026-4289 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool webfetchtool, or the WebFetch capability's local fallback to untrusted prompts can be driven to fet...
PYSEC-2026-4287 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...
PYSEC-2026-4290 Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...
PYSEC-2026-4274 Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to...
PYSEC-2026-4283 Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to...
PYSEC-2026-4281 Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...
PYSEC-2026-4284 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message content — from exported telemetry, so that agents can be monitored withou...
PYSEC-2026-4275 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsincludecontent=False to exclude message content — user prompts, model completions, tool call arguments and responses, and any other message content — from exported telemetry, so that agents can be monitored withou...
PYSEC-2026-4286 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...
PYSEC-2026-4277 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...
PYSEC-2026-4282 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...
PYSEC-2026-4291 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...
CLEANSTART-2026-LH67222 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...
CLEANSTART-2026-DV71311 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...