pydantic-ai web_fetch DoS via quadratic response processing CVE-2026-107290

Vulnerability Overview Title: Event loop blocked by quadratic response processing in Description: The local utility (also used as the local fallback for the capability) exhibits quadratic growth in execution time as the size of certain server-controlled input increases during response processing. This includes decoding response bodies with charset declarations, extracting page titles using regex with backtracking, and converting HTML to Markdown. Attackers can exploit this utility to maliciously manipulate untrusted prompts, such as by fetching a page of one megabyte or larger, thereby blocking the event loop for several minutes and preventing other coroutines from running in the process—including other agent operations and servicing other requests—during this period. Impact Scope Affected Versions: - : >= 1.77.0, = 1.77.0, < 1.107.6 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2026-107290 Weaknesses: - CWE-407 - CWE-1333 Remediation Upgrade to the patched version. The title extraction now uses a single linear scan, and the conversion steps run in linear time. Decoding, title extraction, and conversion all execute in worker threads. If a charset name denotes a non-text encoding, the system reports a failed fetch to the model rather than aborting the run. If the JSON body is nested too deeply to parse, it is returned as plain text. Details Title Extraction: Traversing the response body using backtracking patterns results in time complexity proportional to the square root of the tag size. The HTML-to-Markdown conversion suffers from similar issues, involving whitespace normalization, stripping preformatted blocks, and handling numbered ordered lists. Response Body Decoding: Decoding the response body using the parameter involves looking up Python's character set registry. Some decoders (such as ) require time proportional to the response body size. HTML to Markdown Conversion: Recursive processing of nested elements can potentially lead to a . Who is Affected Applications that register the local utility and expose it to untrusted prompts may be affected. The configuration narrows the exposure scope but does not eliminate the risk entirely. Applications that only fetch URLs controlled by developers are not affected by this attack path originating from model selection. Credits Reported by @BrianWillows, whose report covered the quadratic title extraction. The quadratic steps in response decoding, non-text encoding handling, and HTML-to-Markdown conversion were discovered during the fix implementation.

Goal Reached Thanks to every supporter — we hit 100%!

pydantic-ai web_fetch DoS via quadratic response processing CVE-2026-107290

More from this source