pydantic-ai v1.107.6 Security Advisory: SSRF bypass and DoS fixes

Vulnerability Overview In the release of , four security vulnerabilities were identified and subsequently fixed. Details for each vulnerability are provided below: 1. GHSA-vmxc-h2x2-jmf3 (moderate) - Description: Cloud metadata and private IP blacklist bypass via an IPv6 zone identifier when opting into local network access via URLs. - Reporter: @euriconciacio - Related Issues: #8403 2. GHSA-fp41-vwcp-v4hp (moderate) - Description: Superlinear response handling in HTML conversion and character set decoding in , causing event loop blocking. - Reporter: @BrianWillows - Related Issues: #8395, #8434 3. GHSA-22h6-qm39-v87j (low) - Description: domain list comparison performed as string matching rather than using the parser's canonical form. - Reporter: @BrianWillows - Related Issues: #8409 4. GHSA-4x9p-g9wm-8q7f (low) - Description: OpenTelemetry spans carried exceptions, error statuses, instructions, and output templates even when . - Reporter: @BrianWillows - Related Issues: #8404, #8422, #8429 Affected Versions The four security vulnerabilities mentioned above have been fixed in version v1.107.6. These vulnerabilities affected the series of . Remediation All four security vulnerabilities have been resolved in version v1.107.6. Fix details include: - Remediation of cloud metadata and private IP blacklist bypass. - Resolution of event loop blocking caused by superlinear response handling in . - Correction of domain list comparison logic in . - Prevention of sensitive information leakage in OpenTelemetry spans. Other Changes Version v1.107.6 also includes the following maintenance updates: - Fixes for and along with their , , and extensions (backported to v1). - Fixes for within the extension for . Contributors DouweM euriconciacio BrianWillows Resources Source Code (zip) Source Code (tar.gz) The above information summarizes the security vulnerabilities and their remediation status in the release.

Goal Reached Thanks to every supporter — we hit 100%!

pydantic-ai v1.107.6 Security Advisory: SSRF bypass and DoS fixes

More from this source