PYDANTIC · GHSA-49g6-96jj-f7r9 · Package
FIX → 1.10.27
Pydantic V1 checks each item in a list constrained with unique_items=True against all following items, so validating a large untrusted list costs quadratic time. An attacker sending a list of a few hundred kilobytes can make validation take seconds, causing denial of service.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Pydantic V1 (versions 1.9.0 through 1.10.26) to validate untrusted input into list fields marked unique_items=True, via conlist() or Field(). Pydantic V2 models are not affected, and lists of scalar types were fixed separately from lists of models or dictionaries, which remain slow unless bounded with max_items.
Not affected if max-items-set, no-untrusted-list-input, pydantic-v2-models
Who cares pydantic, pydantic-v1, python
pip show pydantic and look for a 1.x version between 1.9.0 and 1.10.26.unique_items=True, conlist( and Field( with unique_items to find fields that validate untrusted lists.Validating an untrusted list into a field constrained with unique_items=True with Pydantic V1 takes quadratic time: an input of a few hundred kilobytes takes seconds to validate.
The ConstrainedList.unique_items_validator validator (in pydantic/types.py) checks each item against all the following ones:
@classmethod
def unique_items_validator(cls, v: 'Optional[List[T]]') -> 'Optional[List[T]]':
if v is None:
return None
for i, value in enumerate(v, start=1):
if value in v[i:]:
raise errors.ListUniqueItemsError()
v
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
max_items constraint.Upgrade to 1.10.27
1.10.27 or later, per the fixed version in the product data.max_items as a workaround until upgrading.pydantic.v1 under V2, upgrade to 2.14.2 or later per the advisory.For a list with no duplicates (the common, valid case), this results in a quadratic number of comparisons.
The issue was fixed in commit https://github.com/pydantic/pydantic/commit/6ec75e57f277a820ec583e601167f25fe8dc7c87.
If you are relying on the pydantic.v1 namespace in Pydantic V2, upgrade to V2.14.2 or later.
Denial of service through validation of untrusted input. Affected are applications validating untrusted lists into fields constrained with unique_items=True (using conlist() or Field()).
The fix only applies to lists of builtin scalar types (int, float, str, bytes, bool and None), for which duplicates can be detected in linear time. Lists of other types (e.g. models or dictionaries) are still checked in quadratic time, as their items aren't guaranteed to be hashable: bound their size using the max_items constraint.
Pydantic V2 models are not affected.