Which pydantic-ai versions fix the web_fetch_tool stall?

Pydantic ships the fix in pydantic-ai 1.107.9 and 2.59.0, in the matching pydantic-ai-slim releases, and in any later release on the same major line. Affected ranges run from 1.77.0 up to but not including 1.107.9, and from 2.0.0 up to but not including 2.59.0. Teams that cannot upgrade should stop pointing web_fetch_tool at HTML an attacker can influence.

Can the pydantic-ai web_fetch_tool flaw leak agent data?

Pydantic's advisory records availability impact only, rating confidentiality and integrity none in its CVSS vector. The reported effect is a worker held for a long time, which delays other work in the same process, plus memory use several times the fetched page's size when single tags are very large. No data theft or code execution is described.

Does the pydantic-ai web_fetch_tool advisory have a CVE?

No CVE is assigned to GHSA-4whf-38hw-pxxh, which Pydantic published on October 21, 2026 and rates High at CVSS 7.5, so internal tracking needs the GHSA identifier. A separate advisory published the same day, CVE-2026-114386 in pydantic-ai-harness before 0.59.0, covers an unrelated flaw where nested CodeMode calls skipped the operator's tool-call limit.

MEDVulnerability

Pydantic AI: attacker-controlled HTML stalls the agent's shared worker pool

Pydantic AI before 1.107.9 and 2.59.0 lets one fetched page tie up the worker pool that every request in the process shares.

October 21, 2026 · Pydantic · Research by SounLabs

Pydantic AI

MEDVulnerability

Pydantic AI's web_fetch_tool can be tied up by a fetched page with very many HTML elements, delaying unrelated work in the same process. Pydantic rates it High and fixed it in 1.107.9 and 2.59.0. SounLabs reported the flaw.

01What happened

Pydantic published a security advisory for pydantic-ai on October 21, 2026 after SounLabs reported that the framework's web_fetch_tool could be slowed to a crawl by hostile HTML. Pydantic rates the issue High, with a CVSS base score of 7.5 covering availability only. Fixes are out in 1.107.9 and 2.59.0.

02How it works

Turning fetched HTML into text monopolizes a worker pool that the whole process shares, so one page with many elements keeps unrelated requests waiting. Pydantic's advisory adds that very large tags can make the conversion use many times the page's size in memory, which can exhaust process memory. Earlier affected versions ran the conversion on the event loop instead of a worker. Picking the URL the agent fetches is enough to trigger it.

03Who is affected

Applications built on pydantic-ai or pydantic-ai-slim in the version ranges listed below are exposed when an agent holds web_fetch_tool and can reach HTML an attacker influences. Pydantic's score assumes unauthenticated users can prompt such an agent and choose the URL.

04What to do

Upgrade to pydantic-ai 1.107.9 or 2.59.0, or a later release on the same major line. Until then Pydantic says to avoid fetching attacker-controlled HTML with web_fetch_tool.

Questions people ask

Which pydantic-ai versions fix the web_fetch_tool stall?: Pydantic ships the fix in pydantic-ai 1.107.9 and 2.59.0, in the matching pydantic-ai-slim releases, and in any later release on the same major line. Affected ranges run from 1.77.0 up to but not including 1.107.9, and from 2.0.0 up to but not including 2.59.0. Teams that cannot upgrade should stop pointing web_fetch_tool at HTML an attacker can influence.
Can the pydantic-ai web_fetch_tool flaw leak agent data?: Pydantic's advisory records availability impact only, rating confidentiality and integrity none in its CVSS vector. The reported effect is a worker held for a long time, which delays other work in the same process, plus memory use several times the fetched page's size when single tags are very large. No data theft or code execution is described.
Does the pydantic-ai web_fetch_tool advisory have a CVE?: No CVE is assigned to GHSA-4whf-38hw-pxxh, which Pydantic published on October 21, 2026 and rates High at CVSS 7.5, so internal tracking needs the GHSA identifier. A separate advisory published the same day, CVE-2026-114386 in pydantic-ai-harness before 0.59.0, covers an unrelated flaw where nested CodeMode calls skipped the operator's tool-call limit.

Sources 4 links, all fetched

1github.comPydantic Advisory
2github.comRelease 1.107.9
3github.comRelease 2.59.0
4github.comHarness Advisory