# CVE-2026-107294: Pydantic AI unbounded memory use in remote content download

Source: https://junglewise.ai/threats/cve-2026-107294-pydantic-ai-unbounded-memory-use-when-downloading-remote-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107294 · Severity: medium · CVSS 6.5 · Published 2026-10-08

Pydantic AI is a framework for building AI applications with structured data validation. An attacker can exploit the web-fetch tool or remote file downloads to stream extremely large responses that consume all available memory, crashing the application and causing a denial of service. This affects applications that allow untrusted users to influence what URLs or files are fetched.

Technologies: [Pydantic AI](https://junglewise.ai/threats/technologies/pydantic-pydantic-ai), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107294 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107294 being exploited in the wild.

**How severe is CVE-2026-107294?** Medium severity, with a CVSS score of 6.5, published 8 October 2026.

**Which products and versions are affected?** Pydantic AI before 2.24.0 (v2) or 1.107.2 (v1); pydantic-ai (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0; pydantic-ai-slim (PyPI) ECOSYSTEM:introduced=1.77.0,fixed=1.107.2,introduced=2.0.0b1,fixed=2.24.0.

**Is there a fix for CVE-2026-107294?** Yes. pydantic-ai (PyPI): upgrade to 2.24.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.24.0 or later. Until then: Avoid exposing the web-fetch tool or FileUrl downloads to untrusted prompts or user input. If exposure is necessary, restrict the URLs that can be fetched to a developer-controlled allowlist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107294 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107294?** Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 2.24.0 or later

  ```sh
  pip install "pydantic-ai>=2.24.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 2.24.0 or later

  ```sh
  pip install "pydantic-ai-slim>=2.24.0"
  ```


Avoid exposing the web-fetch tool or FileUrl downloads to untrusted prompts or user input. If exposure is necessary, restrict the URLs that can be fetched to a developer-controlled allowlist.

## Technical details

The vulnerability exists in download helpers that buffer entire HTTP response bodies into memory before applying content-size limits. The web-fetch tool and FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl) lack streaming-level caps, allowing an attacker-controlled URL to exhaust process memory. The SSRF protections remain intact; this is purely an availability issue.

## Affected products

- Pydantic Pydantic AI before 2.24.0 (v2) or 1.107.2 (v1)

## Identifiers

- CVE-2026-107294
- GHSA-v2xh-2vp8-57h8
- PYSEC-2026-4280
- PYSEC-2026-4289

## Timeline

- 2026-10-08: disclosed: Identified during internal review of media-download hardening

## Related threats

- [Pydantic AI concurrency slot leak in streamed requests](https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when)
- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)