pydantic-ai-slim is vulnerable to Regular Expression Denial of Service (ReDoS)
65
CVE Score
Medium
Regular Expression Denial of Service (ReDoS)
The local web_fetch_tool (also used as the WebFetch capability's fallback) decodes a fetched response, extracts its title with a backtracking regular expression, and converts it to markdown; several of those steps run in time proportional to the square of the input size. A server controlled response of a megabyte or two can block the event loop for minutes, stalling every other coroutine in the process for the duration. The fix bounds and restructures the title extraction and markdown conversion so their running time no longer grows quadratically with response size.
Upgrade the pydantic-ai-slim and/or the pydantic-ai library to the patch version.
You are affected if you are using a version that falls within the vulnerable range and you expose the web_fetch_tool (or the WebFetch capability's local fallback) to fetch content from an untrusted host.
1.77.0 - 1.107.5
Fixed in 1.107.62.0.0 - 2.43.0
Fixed in 2.44.0pydantic-ai-slim is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 1.77.0 - 1.107.5 and 2.0.0 - 2.43.0.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.