CVE-2026-107294

MediumCVSS 6.5/10Last modified Oct 13, 2026

Description

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
pydantic	pydantic-ai	>= 1.77.0, < 1.107.2; >= 2.0.0b1, < 2.24.0
pydantic	pydantic-ai-slim	>= 1.77.0, < 1.107.2; >= 2.0.0b1, < 2.24.0

References

https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1dPatch
https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8Patch
https://github.com/pydantic/pydantic-ai/pull/7141Patch, Issue Tracking
https://github.com/pydantic/pydantic-ai/pull/7308Patch, Issue Tracking
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2Patch, Release Notes
https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0Patch, Release Notes, Vendor Advisory
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8Vendor Advisory

Timeline

Published: Oct 8, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1072957.6Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, th CVE-2026-1072963.7msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the CVE-2026-1072975.9msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or m CVE-2026-1072985.3msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth CVE-2026-1072995.9msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack b CVE-2026-10734.3The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including CVE-2026-1073007.5msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for ea CVE-2026-1073016.5msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options CVE-2026-1073027.5msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value CVE-2026-1073037.6JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to CVE-2026-1073055.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1073063.8Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Sto