CVE-2026-107288

A flaw was found in pydantic-ai. The web fetching utilities fail to normalize domain names before checking them against the configured blocklist. A remote attacker capable of influencing the model output can supply alternate character encodings, case variations, or trailing labels that resolve to...

CVE-2026-107289

A flaw was found in pydantic-ai. This vulnerability can lead to information disclosure, potentially exposing sensitive cloud credentials such as Identity and Access Management IAM tokens. In configurations where local network access is permitted for untrusted requests, a remote attacker can bypas...

CVE-2026-107294

A flaw was found in Pydantic AI. When fetching remote web content or media files, the framework buffers the entire response in memory before enforcing content-size limits. A remote attacker can exploit this issue by supplying a link that streams an excessively large response, exhausting memory an...

CVE-2026-107293

A flaw was found in pydantic-ai. An information disclosure vulnerability occurs when OpenTelemetry instrumentation is configured to omit message contents, as retry prompts generated during output validation are still exported to the telemetry backend. A user with read access to telemetry logs can...

CVE-2026-107291

A flaw was found in Pydantic AI. When OpenTelemetry instrumentation is configured to exclude content, sensitive agent data is still exported to the telemetry backend through exception details, error status descriptions, and model request parameters. An attacker or unauthorized user with read acce...

CVE-2026-107292

A flaw was found in pydantic-ai. The web development chat server fails to validate incoming HTTP Host headers, allowing a remote attacker to achieve unauthorized tool execution and information disclosure. If a developer running the local development server visits a malicious website, an attacker...

CVE-2026-107290

A flaw was found in pydantic-ai. An inefficient content parsing mechanism in the web fetching component allows a remote attacker serving a crafted web page to trigger a Denial of Service DoS. By providing specially structured or deeply nested content, the attacker can block the application's even...

CVE-2026-107287

A flaw was found in pydantic-ai. When local web fetching processes attacker-controlled web content, converting HTML containing deeply nested block elements into Markdown causes excessive CPU and memory consumption. A remote attacker can exploit this vulnerability to trigger a Denial of Service Do...

CVE-2026-107295

A flaw was found in pydantic-ai-slim. The local development chat interface does not properly validate request content types, allowing a malicious website visited by a developer to send cross-origin requests to the locally hosted server. A remote attacker can exploit this vulnerability to trigger...

CVE-2026-107286

A flaw was found in pydantic-ai. When processing streamed requests under concurrency limits, shared concurrency slots may fail to release if a stream is interrupted, cancelled, or encounters an exception. A remote caller can exploit this issue by triggering incomplete streaming operations to...

GHSA-6FQQ-452J-QHRP Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

GHSA-V36G-JCW9-X7CW Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

CVE-2026-107294

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, webfetchtool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An...

CVE-2026-107295

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.toweb and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a...

CVE-2026-107290

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-107293

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can export retry prompts outside tool calls in genai.input.messages an...

CVE-2026-107292

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

CVE-2026-107291

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...