{"action":"Upgrade pydantic-ai-slim to 1.107.6 or later.","affected":[{"fixed":"1.107.6","introduced":"1.77.0"},{"fixed":"2.44.0","introduced":"2.0.0b1"}],"component":"pydantic-ai-slim","cve_ids":["CVE-2026-107290"],"ecosystem":"PyPI","epss":0.00512,"exploited":false,"fixed_versions":["1.107.6","2.44.0"],"ghsa_id":"GHSA-fpf4-vwcp-v4hp","id":"tcs_01M5KFFQA07ECQDWNSD4JM4KPN","modified_at":"2026-10-15T14:56:08.216259462Z","published_at":"2026-10-08T16:48:25Z","references":["https://osv.dev/vulnerability/GHSA-fpf4-vwcp-v4hp","https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp","https://github.com/pydantic/pydantic-ai/pull/8397","https://github.com/pydantic/pydantic-ai/pull/8399","https://github.com/pydantic/pydantic-ai/pull/8418","https://github.com/pydantic/pydantic-ai/pull/8433","https://github.com/pydantic/pydantic-ai/pull/8434","https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0","https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b","https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389","https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920","https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1","https://github.com/pydantic/pydantic-ai","https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6","https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-fpf4-vwcp-v4hp#PyPI/pydantic-ai-slim","url":"https://osv.dev/vulnerability/GHSA-fpf4-vwcp-v4hp"}],"summary":"Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`"}