CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Attackers can crash Pydantic AI workers by streaming large responses via web_fetch or FileUrl, exhausting memory before size checks apply.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107294?
CVE-2026-107294 is a medium-severity denial of service vulnerability in pydantic-ai, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.
Weakness: CWE-400
Which versions are affected by CVE-2026-107294?
10 open source packages ship an affected version, including pydantic-ai and pydantic-ai-slim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pydantic-ai PyPI | From 1.77.0 | 1.107.2, 2.24.0 |
pydantic-ai PyPI | From 1.77.0 | 1.107.2 |
pydantic-ai PyPI | From 1.77.0 | 1.107.2 |
pydantic-ai PyPI | From 2.0.0b1 | 2.24.0 |
pydantic-ai PyPI | From 2.0.0b1 | 2.24.0 |
pydantic-ai-slim PyPI | From 1.77.0 | 1.107.2, 2.24.0 |
4 more packages
pydantic-ai-slim PyPI | From 1.77.0 | 1.107.2 |
pydantic-ai-slim PyPI | From 1.77.0 | 1.107.2 |
pydantic-ai-slim PyPI | From 2.0.0b1 | 2.24.0 |
pydantic-ai-slim PyPI | From 2.0.0b1 | 2.24.0 |
Products include Pydantic Pydantic Ai.
How do I fix CVE-2026-107294?
Upgrade pydantic-ai to a fixed version for your release line: 1.107.2 or 2.24.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107294 being exploited?
There is no known exploitation of CVE-2026-107294 in the wild and no public exploit code.
Other vulnerabilities in pydantic-ai
- CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
- CVE-2026-107295 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
- CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
- CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Sources
Also known as CLEANSTART-2026-EE95279, GHSA-v2xh-2vp8-57h8, PYSEC-2026-4280, PYSEC-2026-4289.