PYDANTIC · GHSA-gj4f-r7mf-jjxh · Package
FIX → 2.14.0
Pydantic validates a string such as '1e8000000' into a Fraction field by computing a huge power of ten with no limit, so a few bytes of input take seconds to process. An attacker who can send untrusted input to such a field can tie up the server and cause a denial of service.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Pydantic from 2.10.0 up to but not including 2.14.0 and validate untrusted strings into Fraction fields, in JSON or Python mode, including strict mode. Applications without Fraction fields, or that only validate trusted input, are not exposed.
Not affected if no-fraction-fields, trusted-input-only
Who cares fraction, pydantic, python, self-hosted
pip show pydantic or python -c "import pydantic; print(pydantic.VERSION)".Fraction fields in Pydantic models that accept untrusted strings.Upgrade to 2.14.0
pydantic 2.14.0: exponents larger than 4300 in absolute value are rejected.Validating an untrusted string in exponent notation into a Fraction field computes the full power of ten without any bound: an input of a few bytes takes seconds to validate.
String inputs are passed to the Fraction constructor. For strings in exponent notation (e.g. '1e8000000'), CPython computes the corresponding power of ten as an integer (Lib/fractions.py):
exp = m.group('exp')
if exp:
exp = int(exp)
if exp >= 0:
numerator *= 10**exp
else:
denominator *= 10**-exp
The issue was fixed in commit https://github.com/pydantic/pydantic/commit/69ed168e9ad465eef4c8d81efb152a93b604daf5. For strings in exponent notation, the exponent is now parsed before calling the constructor, and exponents larger than 4300 (in absolute value) are rejected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
FractionDenial of service through validation of untrusted input. Affected are applications validating untrusted strings into Fraction fields (in both JSON and Python mode, including in strict mode), using Pydantic from 2.10.0 up to (but excluding) 2.14.0.
From 2.14.0, exponents larger than 4300 (in absolute value) are rejected, matching the maximum number of digits accepted for integers.