pydantic-ai-slim
How Python does AI. Agents, realtime voice, image generation, embeddings. Every model, every interface, typed end to end.
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 349
- Cadence
- ~daily
- Last 12 months
- 196
Reach
- Stars
- 20.9k
Details
- License
- MIT
- First release
- Nov 25, 2024
| Version | Released | |
|---|---|---|
2.63.0
minor
| ||
2.62.0
minor
| ||
2.61.0
minor
| ||
2.60.0
minor
| ||
2.59.0
minor
| ||
1.107.9
patch
| ||
1.107.8
patch
| ||
2.58.0
minor
| ||
2.57.0
minor
| ||
2.56.0
minor
| ||
2.55.0
minor
| ||
2.54.0
minor
| ||
2.53.0
minor
| ||
2.52.0
minor
1 CVE
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.107.7
patch
| ||
2.51.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.50.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.49.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.48.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.47.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.46.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.45.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.107.6
patch
1 CVE
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.44.0
minor
2 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.43.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.42.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.41.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.40.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.39.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.38.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.37.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.36.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.35.3
patch
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.35.1
patch
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.35.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.34.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.33.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.32.2
patch
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.32.1
patch
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.32.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.31.1
patch
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.31.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.30.0
minor
5 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.107.5
patch
4 CVEs
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.29.0
minor
6 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.107.4
patch
5 CVEs
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.28.0
minor
6 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.27.1
patch
7 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107295
PYSEC-2026-4287
GHSA-h4xc-3qfq-jf93
PYSEC-2026-4278
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
7.6
/ 10
High
Network
Low
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address. ImpactApplications and developers serving an agent through MitigationUpgrade to a patched version. The chat endpoint now requires If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it. Credits
Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.34.0
1.35.0
+ 109 more Show less
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.4
2.28.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
2.27.0
minor
8 CVEs
CVE-2026-107286
PYSEC-2026-4285
GHSA-6fqq-452j-qhrp
PYSEC-2026-4276
Oct 15, 2026
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
SummaryApplications that wrap a model with In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding. Agent-level DetailsThe built-in limiter uses Early termination includes stopping iteration, a consumer exception, and cancellation. Fully consuming MitigationUpgrade to a patched release of Affected versions
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
+ 38 more Show less
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
Fixed in
2.53.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107295
PYSEC-2026-4287
GHSA-h4xc-3qfq-jf93
PYSEC-2026-4278
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
7.6
/ 10
High
Network
Low
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address. ImpactApplications and developers serving an agent through MitigationUpgrade to a patched version. The chat endpoint now requires If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it. Credits
Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.34.0
1.35.0
+ 109 more Show less
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.4
2.28.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107293
PYSEC-2026-4283
GHSA-3gh4-cghq-f8v4
PYSEC-2026-4274
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises DetailsRetry prompts without an associated tool call were serialized into span message attributes (such as ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version; retry prompt content now honors Workaround for Unpatched VersionsIf you cannot upgrade, scrub or drop the message attributes ( CreditsReported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 197 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.4
2.27.1
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev | ||
1.107.2
patch
7 CVEs
CVE-2026-107287
PYSEC-2026-4290
GHSA-v36g-jcw9-x7cw
PYSEC-2026-4281
Oct 15, 2026
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
6.5
/ 10
Medium
Network
Low
None
Required
Unchanged
None
None
High
SummaryApplications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. DetailsNested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop. MitigationUpgrade to a patched release of Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 98 more Show less
1.107.6
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.5.0
2.5.1
2.50.0
2.51.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.7
2.52.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107292
PYSEC-2026-4288
GHSA-q2xc-rrxj-58x9
PYSEC-2026-4279
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
6.4
/ 10
Medium
Network
High
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( DetailsOnce a name the attacker controls resolves to the loopback address, the browser treats the request as same-origin, so neither an Binding the web UI to localhost — the default — does not prevent this. ImpactApplications and developers serving an agent through Current browser protections reduce but do not remove this exposure: Chromium's Local Network Access gates loopback subresource requests, but does not cover top-level navigations, and Safari does not implement it. MitigationUpgrade to The fix validates the Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.34.0
+ 112 more Show less
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.5
2.30.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107295
PYSEC-2026-4287
GHSA-h4xc-3qfq-jf93
PYSEC-2026-4278
Oct 15, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
7.6
/ 10
High
Network
Low
None
Required
Unchanged
Low
High
Low
SummaryThe Pydantic AI development web chat UI ( Binding the web UI to localhost — the default — does not prevent this, because a page open in the developer's browser can reach the loopback address. ImpactApplications and developers serving an agent through MitigationUpgrade to a patched version. The chat endpoint now requires If you cannot upgrade, don't run the web UI while browsing untrusted sites, stop it when you aren't using it, and don't serve an agent with side-effecting tools through it. Credits
Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.34.0
1.35.0
+ 109 more Show less
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.4
2.28.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107293
PYSEC-2026-4283
GHSA-3gh4-cghq-f8v4
PYSEC-2026-4274
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises DetailsRetry prompts without an associated tool call were serialized into span message attributes (such as ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version; retry prompt content now honors Workaround for Unpatched VersionsIf you cannot upgrade, scrub or drop the message attributes ( CreditsReported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 197 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.4
2.27.1
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107290
PYSEC-2026-4286
GHSA-fpf4-vwcp-v4hp
PYSEC-2026-4277
Oct 15, 2026
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
SummaryThe local web-fetch tool ( This is an availability issue only. SSRF protections and the download size limit introduced in GHSA-v2xh-2vp8-57h8 are unaffected; that limit bounds how much is downloaded, not how long the response takes to process. DetailsTitle extraction used a backtracking pattern over the raw response body, so a body made of repeated unterminated tag openings cost time proportional to the square of its size. The HTML-to-markdown conversion had the same shape in three of its steps: normalizing whitespace, stripping preformatted blocks, and numbering ordered lists all took time proportional to the square of a run of spaces or a list's length. All of it ran on the event loop, and the regex steps hold the interpreter lock even when moved off it, so the whole process paid for the size of a server-controlled response. The response body was also decoded on the event loop with the codec named by the Separately, the HTML-to-markdown conversion recursed once per nested element, so a page nested a few hundred elements deep raised a Who Is AffectedYou are affected if your application registers the local web-fetch tool (or relies on the RemediationUpgrade to a patched version. The title is now found with a single linear scan, the conversion steps above run in linear time, and decoding, title extraction and conversion all run in a worker thread. A charset naming a codec that isn't a text encoding, and a page too deeply nested to convert, are reported back to the model as a failed fetch instead of aborting the run; a JSON body too deeply nested to parse is returned as plain text. CreditsReported privately by @BrianWillows, whose report covered the quadratic title extraction. The response decoding, the codecs that are not text encodings, and the quadratic steps in the HTML-to-markdown conversion were found while fixing it. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 89 more Show less
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107291
PYSEC-2026-4284
GHSA-4x9p-g9wm-8q7f
PYSEC-2026-4275
Oct 15, 2026
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
Network
Low
Low
None
SummaryPydantic AI's OpenTelemetry instrumentation supports The message attributes honoured the setting. Several other parts of the same spans did not, and exported content regardless of it:
DetailsContent reaches these places because of what they carry rather than through any single missing check, which is why the setting was applied correctly to the message attributes ( ImpactThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario Who Is AffectedYou are affected if you enabled instrumentation with RemediationUpgrade to a patched version. With Workaround for Unpatched VersionsIf you cannot upgrade, scrub the CreditsReported privately by @BrianWillows, whose report covered the exception events on tool and agent run spans. The remaining paths were found while fixing it, by a test that drives content through every channel at once and checks the whole exported trace. Affected versions
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.4.10
0.4.11
0.4.2
0.4.3
0.4.4
0.4.5
+ 221 more Show less
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.8.0
0.8.1
1.0.0
1.0.0b1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.10.0
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.25.1
1.26.0
1.27.0
1.28.0
1.29.0
1.3.0
1.30.0
1.30.1
1.31.0
1.32.0
1.33.0
1.34.0
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.40.0
1.41.0
1.42.0
1.43.0
1.44.0
1.46.0
1.47.0
1.48.0
1.49.0
1.5.0
1.50.0
1.51.0
1.52.0
1.53.0
1.54.0
1.55.0
1.56.0
1.57.0
1.58.0
1.59.0
1.6.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.7.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.8.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.9.0
1.9.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev
CVE-2026-107289
PYSEC-2026-4291
GHSA-vmxc-h2x2-jmf3
PYSEC-2026-4282
Oct 15, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
6.8
/ 10
Medium
Network
High
None
None
Changed
High
None
None
SummaryWhen an application using Pydantic AI opts a URL into local network access — either a This is an incomplete fix of GHSA-cqp8-fcvh-x7r3 / CVE-2026-46678 and GHSA-cg7w-rg45-pc59 / CVE-2026-48782, themselves follow-ups to CVE-2026-25580. The parent advisory's remediation guaranteed that cloud metadata endpoints are always blocked, even with local access allowed. That guarantee did not hold for zone-scoped spellings of the IPv6 metadata endpoints. DetailsThe cloud-metadata guard compared IPv6 addresses against its blocklist by set membership. Python includes the zone identifier in Only the IPv6 cloud metadata endpoints were reachable this way, so the issue requires an IPv6-enabled environment — for example AWS EC2 or EKS with IPv6, GCP IPv6-only instances, or Scaleway. Who Is AffectedYou are affected only if your application opts a URL that is, or could be, influenced by untrusted input into local network access, through either:
Both are off by default. You are not affected through the
Applications that only download from developer-controlled URLs are not affected. RemediationUpgrade to a patched version. The cloud-metadata and private-IP checks now drop an IPv6 zone identifier before evaluating the address, so every blocklist comparison is made on the address itself. A zone identifier is still carried on the connection, so legitimate link-local fetches under local network access continue to work. Workaround for Unpatched VersionsAvoid opting into local network access — CreditsReported by @euriconicacio. Affected versions
1.100.0
1.101.0
1.102.0
1.103.0
1.104.0
1.105.0
1.106.0
1.107.0
1.107.1
1.107.2
1.107.4
1.107.5
+ 110 more Show less
1.56.0
1.57.0
1.58.0
1.59.0
1.60.0
1.61.0
1.62.0
1.63.0
1.64.0
1.65.0
1.66.0
1.67.0
1.68.0
1.69.0
1.70.0
1.71.0
1.72.0
1.73.0
1.74.0
1.75.0
1.76.0
1.77.0
1.78.0
1.79.0
1.80.0
1.81.0
1.82.0
1.83.0
1.84.0
1.84.1
1.85.0
1.85.1
1.86.0
1.86.1
1.87.0
1.88.0
1.89.0
1.89.1
1.90.0
1.91.0
1.92.0
1.93.0
1.94.0
1.95.0
1.95.1
1.96.0
1.96.1
1.97.0
1.98.0
1.99.0
2.0.0
2.0.0b1
2.0.0b2
2.0.0b3
2.0.0b4
2.0.0b5
2.0.0b6
2.0.0b7
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.2.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.27.1
2.28.0
2.29.0
2.3.0
2.30.0
2.31.0
2.31.1
2.32.0
2.32.1
2.32.2
2.33.0
2.34.0
2.35.0
2.35.1
2.35.3
2.36.0
2.37.0
2.38.0
2.39.0
2.4.0
2.40.0
2.41.0
2.42.0
2.43.0
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
1.107.6
2.44.0
References
Updated Oct 15, 2026 · Source: OSV.dev |