An attacker can supply deeply nested HTML to Pydantic AI’s local web_fetch_tool or its fallback, causing the library to repeatedly reprocess already accumulated text during HTML‑to‑Markdown conversion. This manipulation can exponentially increase intermediate output volume before the model’s returned‑content limit is applied, leading to excessive CPU and memory use. The impact is a denial‑of‑service for the process running the framework. The flaw is a form of Uncontrolled Resource Consumption (CWE‑400) coupled with inefficient looping that resembles a Denial‑of‑Service via resource waste (CWE‑407), and can lead to excessive allocation of resources (CWE‑770).

The vulnerability affects the Pydantic AI libraries pydantic‑ai and pydantic‑ai‑slim. Versions 1.77.0 through 1.107.6 (inclusive) and any 2.x build prior to 2.52.0 are impacted. Fixed versions are 1.107.7 and 2.52.0 and later releases.

With a CVSS score of 6.5 the flaw is rated as moderate severity. EPSS data is not available and the issue is not currently catalogued in CISA’s KEV list, indicating limited evidence of widespread exploitation. The likely attack vector involves an attacker who can control the input passed to the local web_fetch_tool or trigger a model‑directed fetch that supplies malicious nested HTML. Because the tool runs in‑process, the attacker can achieve denial of service against the host application without any network interaction, but requires the attacker to deliver the crafted HTML through the application’s fetch interface or by embedding it in a model prompt. The vulnerability’s exploitation does not involve arbitrary code execution or privilege escalation, but it can substantially degrade service availability for the affected process.