CVE-2026-107290
Description
A flaw was found in pydantic-ai. An inefficient content parsing mechanism in the web fetching component allows a remote attacker serving a crafted web page to trigger a Denial of Service (DoS). By providing specially structured or deeply nested content, the attacker can block the application's event loop or abort active tasks, stalling other requests and agent runs.
Statement
A flaw of MODERATE impact was found in the pydantic-ai Python agent framework, which is shipped in Red Hat products including Red Hat Enterprise Linux AI (rhel-ai-3) and Lightspeed Core (lightspeed-core-0). The local web-fetch tool (web_fetch_tool, also used as the local fallback for the WebFetch capability) processes server-controlled responses with steps whose running time grows quadratically with the size of certain inputs, including title extraction with a backtracking regular expression, whitespace normalization, and ordered-list numbering, and runs them on the application's event loop. A remote attacker who can steer an agent that is exposed to untrusted prompts to fetch an attacker-controlled web page of modest size can block the event loop for an extended period, stalling every other coroutine in the process, including other agent runs and requests. Response bodies declaring codecs that are not text encodings, or excessively nested HTML or JSON content, can also abort the individual agent run that fetched them. This is an availability-only issue with no impact on confidentiality or integrity. All currently listed Red Hat affects are marked AFFECTED with a resolution of DEFER: because the impact is MODERATE and the CVSS 3.1 score is 6.5 (below 7.0), Red Hat does not file trackers for flaws at this severity, so the fix is deferred and the residual risk remains denial of service in deployments whose agents fetch web content that an attacker can influence. This rating matches the upstream severity of Moderate (CVSS 3.1 score 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream's remediation is to upgrade to a patched version of pydantic-ai. Exposure can additionally be reduced by not exposing the web-fetch tool to untrusted prompts and restricting fetched URLs to developer-controlled locations; upstream notes that configuring allowed_domains narrows but does not remove the exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
