---
id: "GHSA-49g6-96jj-f7r9"
page: "https://infrastack.ai/live/GHSA-49g6-96jj-f7r9"
kind: "vulnerability"
aliases: ["GHSA-49g6-96jj-f7r9"]
title: "Quadratic time unique_items list validation in Pydantic V1"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pydantic", "note": "1.9.0,<=1.10.27", "fixed": ["1.10.27"], "affected": "1.9.0, <= 1.10.27", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-407", "package", "pydantic", "pydantic-v1", "python"]
not_affected_if: ["max-items-set", "no-untrusted-list-input", "pydantic-v2-models"]
published_at: "2026-10-29T16:48:03+00:00"
first_seen_at: "2026-11-09T22:53:21+00:00"
updated_at: "2026-11-09T22:54:34+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/pydantic/pydantic/security/advisories/GHSA-49g6-96jj-f7r9", "first_seen_at": "2026-11-09T22:53:21+00:00"}]
exploit_sources: []
---

# Quadratic time unique_items list validation in Pydantic V1

Link for people: https://infrastack.ai/live/GHSA-49g6-96jj-f7r9 (this .md is for agents)

Pydantic V1 checks each item in a list constrained with unique_items=True against all following items, so validating a large untrusted list costs quadratic time. An attacker sending a list of a few hundred kilobytes can make validation take seconds, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pydantic affected 1.9.0, <= 1.10.27 fixed 1.10.27

## How to check

- Check the installed Pydantic version with `pip show pydantic` and look for a `1.x` version between `1.9.0` and `1.10.26`.
- Search the codebase for `unique_items=True`, `conlist(` and `Field(` with `unique_items` to find fields that validate untrusted lists.
- Check whether those list fields have a `max_items` constraint.

## Fix

- Pydantic (PyPI) `1.10.27` or later, per the fixed version in the product data.
- For lists of non-scalar types (models, dictionaries), the advisory says to bound list size with `max_items` as a workaround until upgrading.
- Pydantic V2 models are not affected; if using `pydantic.v1` under V2, upgrade to `2.14.2` or later per the advisory.

## Timeline

- 2026-11-09T22:53:21+00:00 ghsa-repo https://github.com/pydantic/pydantic/security/advisories/GHSA-49g6-96jj-f7r9

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/pydantic/pydantic/security/advisories/GHSA-49g6-96jj-f7r9

## From the sources

### Summary

Validating an untrusted list into a field constrained with `unique_items=True` with Pydantic V1 takes quadratic time: an input of a few hundred kilobytes takes seconds to validate.

### Details

The [`ConstrainedList.unique_items_validator`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/types.py#L612-L620) validator (in [`pydantic/types.py`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/types.py)) checks each item against all the following ones:

```python
@classmethod
def unique_items_validator(cls, v: 'Optional[List[T]]') -> 'Optional[List[T]]':
    if v is None:
        return None

    for i, value in enumerate(v, start=1):
        if value in v[i:]:
            raise errors.ListUniqueItemsError()

    return v
```

For a list with no duplicates (the common, valid case), this results in a quadratic number of comparisons.

The issue was fixed in commit https://github.com/pydantic/pydantic/commit/6ec75e57f277a820ec583e601167f25fe8dc7c87.

If you are relying on the `pydantic.v1` namespace in Pydantic V2, upgrade to [V2.14.2](https://github.com/pydantic/pydantic/releases/tag/v2.14.2) or later.

### Impact

Denial of service through validation of untrusted input. Affected are applications validating untrusted lists into fields constrained with `unique_items=True` (using `conlist()` or `Field()`).

The fix only applies to lists of builtin scalar types (`int`, `float`, `str`, `bytes`, `bool` and `None`), for which duplicates can be detected in linear time. Lists of other types (e.g. models or dictionaries) are still checked in quadratic time, as their items aren't guaranteed to be hashable: bound their size using the `max_items` constraint.

Pydantic V2 models are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_