CVE-2026-107287: Pydantic AI: Excessive resource use when local web fetching converts nested HTML

In the HTML-to-Markdown conversion, each level of nested block elements makes the converter reprocess the text accumulated so far, so the intermediate output grows far beyond the page size. The response-body limit caps downloaded bytes, and the returned-content limit applies only after conversion, so neither prevents the blow-up.

An attacker needs a page that the agent will fetch: a link in a prompt, a search result, or a document in context. The CVSS vector marks user interaction as required for this reason. On current releases, conversion runs in a worker thread, but it can still consume substantial resources and delay other work in the process. Older releases ran it on the event loop, which stalls the whole service. The result is denial of service for the agent host. No data is exposed.

Affected: pydantic-ai and pydantic-ai-slim from 1.77.0 up to 1.107.7, and from 2.0.0b1 up to 2.52.0, when the agent uses the local web-fetch tool. Provider-native web fetching is not affected.

pip show pydantic-ai pydantic-ai-slim

Search your code for web_fetch_tool to see where it is enabled.

Upgrade to 1.107.7 on the 1.x line, or 2.52.0 on the 2.x line:

pip install --upgrade pydantic-ai

Use pydantic-ai-slim if that is your package. If you cannot upgrade, avoid using local web fetching for attacker-controlled HTML. Also consider running agents that fetch untrusted pages in a process with memory and CPU limits, so a bad page cannot starve other work.

Look for agent processes with CPU or memory spikes right after a web fetch, out-of-memory kills, and slow responses from the same process while a fetch is running. Correlate with the URLs the agent fetched around that time. The advisory lists no log signature.

Summary

Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected.

Details

Nested block elements cause HTML-to-Markdown conversion to reprocess accumulated text at each level and can greatly expand the intermediate output. The response-body limit bounds downloaded bytes, while the returned-content limit is applied only after conversion. On current releases, conversion runs in a worker thread but can still consume substantial resources and delay other work in the process. Older releases performed conversion on the event loop.

Mitigation

Upgrade to a patched release of pydantic-ai or pydantic-ai-slim. If you cannot upgrade yet, avoid using local web fetching for attacker-controlled HTML.