CVE-2026-107287: Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Summary
Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected.
Details
Nested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop.
Mitigation
Upgrade to a patched release of pydantic-ai or pydantic-ai-slim. If you cannot upgrade yet, avoid using local web fetching for attacker-controlled HTML.
Other sources
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML containing deeply nested block elements. Conversion repeatedly reprocesses accumulated text and can greatly expand intermediate output before the returned-content limit is applied, allowing a model-directed fetch to delay other work in the process. Provider-native web fetching is not affected. This issue is fixed in versions 1.107.7 and 2.52.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pydantic-ai-slimto a version that resolves this vulnerability.Fixed in 2.52.0 - Upgrade
Upgrade
pip/pydantic-ai-slimto a version that resolves this vulnerability.Fixed in 1.107.7 - Upgrade
Upgrade
pip/pydantic-aito a version that resolves this vulnerability.Fixed in 2.52.0 - Upgrade
Upgrade
pip/pydantic-aito a version that resolves this vulnerability.Fixed in 1.107.7 - Upgrade
Upgrade
pydantic-ai or pydantic-ai-slimto a version that resolves this vulnerability.Fixed in 1.107.7 - Upgrade
Upgrade
pydantic-ai or pydantic-ai-slimto a version that resolves this vulnerability.Fixed in 2.52.0 - Compensating control
Avoid using local web fetching for attacker-controlled HTML until upgrading.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Pydantic AI's local web_fetch_tool or the local fallback of WebFetch are exposed when they fetch attacker-controlled HTML. Provider-native web fetching is not affected.
What does an attacker need to trigger the resource exhaustion?
An attacker needs a model-directed fetch to retrieve HTML they control containing deeply nested block elements. No authentication is required, but user interaction is required according to the supplied severity vector.
How should this be remediated or mitigated?
Upgrade to Pydantic AI version 1.107.7 or 2.52.0, which contain the fix. If upgrading is not immediately possible, use provider-native web fetching rather than the affected local fetching paths.