CVE-2026-107287Published
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107287 · Microsoft / collected KEV context
cve-program · CVE-2026-107287
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v36g-jcw9-x7cw
- https://github.com/pydantic/pydantic-ai/pull/8984
- https://github.com/pydantic/pydantic-ai/pull/8985
- https://github.com/pydantic/pydantic-ai/commit/2b247add4950bef61d352e7ca8aefbd20539180c
- https://github.com/pydantic/pydantic-ai/commit/2fd38792693da00a3ca5412aeffb436787af3545
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.7
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.52.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.