{"schema":"threatline.record/2","record":{"id":"CVE-2026-107294","aliases":["GHSA-v2xh-2vp8-57h8","PYSEC-2026-4280","PYSEC-2026-4289"],"summary":"Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl","details":"### Summary\n\nSeveral remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool (`web_fetch_tool`, or the `WebFetch` capability's local fallback) to untrusted prompts can be driven to fetch an attacker-chosen URL that streams a very large body, exhausting process memory and crashing the worker. The same unbounded buffering applied to `FileUrl` media downloads (`ImageUrl`, `DocumentUrl`, `VideoUrl`, `AudioUrl`).\n\nThis is an **availability** issue only. SSRF protections (scheme allowlist, private-IP and cloud-metadata blocking) are unaffected; there is no confidentiality or integrity impact.\n\n### Details\n\nThe download helpers read the full response body before applying content-size controls, so an existing text-length limit only truncated *after* the whole body was already in memory, and media downloads had no wire-level cap at all. A single large response could grow process memory without bound .\n\n### Who Is Affected\n\nYou are affected if your application registers the local web-fetch tool (or relies on the `WebFetch` capability's local fallback) and exposes the agent to untrusted prompts, or if it downloads large remote `FileUrl`s influenced by untrusted input. Applications that only fetch developer-controlled URLs are not exposed to the model-chosen attack path.\n\n### Remediation\n\nUpgrade to `2.24.0` or later (v2) or `1.107.2` or later (v1). Patched versions enforce a default 50 MiB cap on web-fetch and `FileUrl` downloads while streaming; pass `None` to the limit to restore the previous unbounded behavior.\n\n### Credits\n\nIdentified during internal review of media-download hardening.","categories":["Libraries & packages"],"product":"pydantic-ai","vendor":"pydantic","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"range":">= 1.77.0, < 1.107.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"range":">= 2.0.0b1, <= 2.23.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"range":">= 1.77.0, < 1.107.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"range":">= 2.0.0b1, <= 2.23.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107294","source_modified_at":"2026-10-09T15:15:18.765Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"pydantic-ai","vendor":"pydantic","versions":[{"version":">= 1.77.0, < 1.107.2","status":"affected"},{"version":">= 2.0.0b1, < 2.24.0","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107294","source_modified_at":"2026-10-09T15:15:18.765Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"pydantic-ai-slim","vendor":"pydantic","versions":[{"version":">= 1.77.0, < 1.107.2","status":"affected"},{"version":">= 2.0.0b1, < 2.24.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"ranges":[{"events":[{"introduced":"1.77.0"},{"fixed":"1.107.2"}],"type":"ECOSYSTEM"}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"ranges":[{"events":[{"introduced":"2.0.0b1"},{"fixed":"2.24.0"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"ranges":[{"events":[{"introduced":"1.77.0"},{"fixed":"1.107.2"}],"type":"ECOSYSTEM"}],"versions":["1.100.0","1.101.0","1.102.0","1.103.0","1.104.0","1.105.0","1.106.0","1.107.0","1.107.1","1.77.0","1.78.0","1.79.0","1.80.0","1.81.0","1.82.0","1.83.0","1.84.0","1.84.1","1.85.0","1.85.1","1.86.0","1.86.1","1.87.0","1.88.0","1.89.0","1.89.1","1.90.0","1.91.0","1.92.0","1.93.0","1.94.0","1.95.0","1.95.1","1.96.0","1.96.1","1.97.0","1.98.0","1.99.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"ranges":[{"events":[{"introduced":"2.0.0b1"},{"fixed":"2.24.0"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0b6","2.0.0b7","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"version":"1.107.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai"},"version":"2.24.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"version":"1.107.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-08T17:16:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pydantic-ai-slim"},"version":"2.24.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"version":"1.107.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai","purl":"pkg:pypi/pydantic-ai"},"version":"2.24.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"version":"1.107.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","source_modified_at":"2026-10-15T14:55:51.016328589Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"pydantic-ai-slim","purl":"pkg:pypi/pydantic-ai-slim"},"version":"2.24.0"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00437,"percentile":0.36959,"score_date":"2026-10-23"},"published_at":"2026-10-08T16:59:25.246Z","modified_at":"2026-10-15T14:55:51.016328589Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T17:16:28Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107294","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T15:15:18.765Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-v2xh-2vp8-57h8","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:55:51.016328589Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107294","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/pull/7141","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/pull/7308","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-08T20:23:19.119515Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:51.016328589Z","content_hash":"da350ed2ff395fc781fec902c198f2446e6ef3717a08cb2bbcef221d35274143"}}