Executive brief
Pydantic is a widely used data validation library for Python. A vulnerability exists where providing specific 'infinite' values to date or time fields causes the application to enter an infinite loop. This results in 100% CPU usage, potentially leading to a denial-of-service (DoS) condition where the application becomes unresponsive to other users.
Technical details
A Loop with Unreachable Exit Condition (CWE-835) exists in Pydantic's date and datetime validation logic. When the library processes input values such as 'infinity', 'inf', or float('inf') (including negative variants), the validation process enters an infinite loop. This consumes 100% of a single CPU core's resources. The vulnerability can be triggered remotely if an application exposes Pydantic models to untrusted user input, such as in API endpoints. The issue is resolved in versions 1.6.2, 1.7.4, and 1.8.2. A workaround involves implementing a custom validator to intercept and handle infinite values before they reach the built-in validation logic.
Affected products
- pydantic pydantic < 1.6.2, >= 1.7, < 1.7.4, >= 1.8, < 1.8.2
Timeline
- 2021-05-11: disclosed
- 2021-05-13: advisory