Pydantic-AI Patches Unbounded Memory Use in Downloads
sdksecurityengineermediapython-agentic
patch
Pydantic-AI v1.107.2 addresses a critical security vulnerability where unbounded memory usage during remote content downloads via `web_fetch` or `FileUrl` could crash workers. This patch introduces a default 50 MiB download cap to mitigate the risk. The fix is available in v1.107.2 and v2.24.0, targeting developers using these tools for remote content processing.
Fixes (1) ›
- Bound HTTP response body sizes for web_fetch and media URL downloads by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/7308
Read the original announcement →
https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2
Related releases
- Pydantic-AI v2.29.0 Adds Azure AI Voice Live Support and FastMCP 4 Pydantic AI Releases ·
- Pydantic-AI v1.107.4 Addresses High-Severity Web UI Vulnerability Pydantic AI Releases ·
- Pydantic AI v1.107.3 Patches High-Severity Web Chat UI Vulnerability Pydantic AI Releases ·
- Pydantic-AI v2.28.0 Patches High-Severity Security Flaw, Adds Realtime Speech-to-Speech Pydantic AI Releases ·
- crewAI 1.15.15 Release Adds AI Flow Reporting, Fixes Bugs CrewAI Releases ·
- LangGraph 1.2.11 Adds Trace Policy to Nodes, Updates Checkpoints LangGraph Releases ·