PyPI/pydantic-ai CVE-2026-107290: medium 6.5, EPSS 0.51%
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Action: Upgrade pydantic-ai to 1.107.6 or later.
pip install pydantic-ai==1.107.6pip install pydantic-ai==2.44.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.77.0 | 1.107.6 | - |
| 2.0.0b1 | 2.44.0 | - |
Fixed versions
| 1.107.6 | 2.44.0 |
Sources
- osv: GHSA-fpf4-vwcp-v4hp
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp
- https://github.com/pydantic/pydantic-ai/pull/8397
- https://github.com/pydantic/pydantic-ai/pull/8399
- https://github.com/pydantic/pydantic-ai/pull/8418
- https://github.com/pydantic/pydantic-ai/pull/8433
- https://github.com/pydantic/pydantic-ai/pull/8434
- https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0
- https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b
- https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389
- https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920
- https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1
- https://github.com/pydantic/pydantic-ai
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0
CVE-2026-107290 · published · modified · JSON