Is CVE-2026-107294 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107294 being exploited in the wild.

How severe is CVE-2026-107294?

Medium severity, with a CVSS score of 6.5, published 8 October 2026.

Which products and versions are affected?

Pydantic AI before 2.24.0 (v2) or 1.107.2 (v1); pydantic-ai (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0.

How is CVE-2026-107294 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107294?

Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107294: Pydantic AI unbounded memory use in remote content download

CVE-2026-107294 · Severity: medium · CVSS 6.5 · Published 2026-10-08

Pydantic AI is a framework for building AI applications with structured data validation. An attacker can exploit the web-fetch tool or remote file downloads to stream extremely large responses that consume all available memory, crashing the application and causing a denial of service. This affects applications that allow untrusted users to influence what URLs or files are fetched.

Technologies: Pydantic AI, pydantic-ai (PyPI), pydantic-ai-slim (PyPI). Vendors: Pydantic, PyPI.

Quick answers

Is CVE-2026-107294 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107294 being exploited in the wild.
How severe is CVE-2026-107294?: Medium severity, with a CVSS score of 6.5, published 8 October 2026.
Which products and versions are affected?: Pydantic AI before 2.24.0 (v2) or 1.107.2 (v1); pydantic-ai (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0.
Is there a fix for CVE-2026-107294?: Yes. pydantic-ai (PyPI): upgrade to 2.24.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.24.0 or later. Until then: Avoid exposing the web-fetch tool or FileUrl downloads to untrusted prompts or user input. If exposure is necessary, restrict the URLs that can be fetched to a developer-controlled allowlist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107294 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107294?: Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pydantic-ai (PyPI): upgrade to 2.24.0 or later
```
pip install "pydantic-ai>=2.24.0"
```
pydantic-ai-slim (PyPI): upgrade to 2.24.0 or later
```
pip install "pydantic-ai-slim>=2.24.0"
```

Avoid exposing the web-fetch tool or FileUrl downloads to untrusted prompts or user input. If exposure is necessary, restrict the URLs that can be fetched to a developer-controlled allowlist.

Technical details

The vulnerability exists in download helpers that buffer entire HTTP response bodies into memory before applying content-size limits. The web-fetch tool and FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl) lack streaming-level caps, allowing an attacker-controlled URL to exhaust process memory. The SSRF protections remain intact; this is purely an availability issue.

Affected products

Pydantic Pydantic AI before 2.24.0 (v2) or 1.107.2 (v1)

Identifiers

CVE-2026-107294
GHSA-v2xh-2vp8-57h8
PYSEC-2026-4280
PYSEC-2026-4289

Timeline

2026-10-08: disclosed: Identified during internal review of media-download hardening

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.