CVE-2026-107287
Description
A flaw was found in pydantic-ai. When local web fetching processes attacker-controlled web content, converting HTML containing deeply nested block elements into Markdown causes excessive CPU and memory consumption. A remote attacker can exploit this vulnerability to trigger a Denial of Service (DoS) by exhausting system resources and stalling application tasks.
Statement
Red Hat has rated this flaw as MODERATE severity. The pydantic-ai package, as shipped in Red Hat Enterprise Linux AI and Lightspeed Core container images, is affected by a denial-of-service flaw in its local web fetching. When the local web_fetch_tool or the WebFetch local fallback processes attacker-controlled HTML containing deeply nested block elements, the HTML-to-Markdown conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, consuming excessive CPU and memory and delaying or stalling other work in the process. A remote attacker who controls web content that the application is directed to fetch can use this to exhaust resources and cause a denial of service; exploitation requires user or model interaction to direct the fetch to attacker-controlled content. Confidentiality and integrity are not impacted, and provider-native web fetching is not affected. The fix for the affected Red Hat products is currently deferred because the impact is MODERATE with a CVSS 3.1 score of 6.5, below the threshold at which these product streams file trackers; the residual risk is limited to the availability of the affected process in its execution environment.
Mitigation
A workaround is available: configure agents to use provider-native web fetching, which is not affected by this issue, instead of the local web_fetch_tool or the WebFetch local fallback. Disabling or restricting the local web fetch tool so it cannot be used for model-directed fetches of untrusted URLs also reduces exposure. Upstream has fixed this issue in pydantic-ai 1.107.7 and 2.52.0; however, the fix for the Red Hat delivered products is currently deferred.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
