Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107290 · Microsoft / collected KEV context

cve-program · CVE-2026-107290

• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp
• https://github.com/pydantic/pydantic-ai/pull/8397
• https://github.com/pydantic/pydantic-ai/pull/8399
• https://github.com/pydantic/pydantic-ai/pull/8418
• https://github.com/pydantic/pydantic-ai/pull/84332
• https://github.com/pydantic/pydantic-ai/pull/8434
• https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0
• https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b
• https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389
• https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920
• https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1
• https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0

No related operational record is retained in the current change model.