---
id: "GHSA-gj4f-r7mf-jjxh"
page: "https://infrastack.ai/live/GHSA-gj4f-r7mf-jjxh"
kind: "vulnerability"
aliases: ["GHSA-gj4f-r7mf-jjxh"]
title: "Unbounded exponent in Fraction validation"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pydantic", "note": ">=2.10.0, <2.14.0", "fixed": ["2.14.0"], "affected": ">= 2.10.0, < 2.14.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-400", "fraction", "package", "pydantic", "python", "self-hosted"]
not_affected_if: ["no-fraction-fields", "trusted-input-only"]
published_at: "2026-10-29T17:05:55+00:00"
first_seen_at: "2026-11-09T22:53:21+00:00"
updated_at: "2026-11-09T22:54:56+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/pydantic/pydantic/security/advisories/GHSA-gj4f-r7mf-jjxh", "first_seen_at": "2026-11-09T22:53:21+00:00"}]
exploit_sources: []
---

# Unbounded exponent in Fraction validation

Link for people: https://infrastack.ai/live/GHSA-gj4f-r7mf-jjxh (this .md is for agents)

Pydantic validates a string such as '1e8000000' into a Fraction field by computing a huge power of ten with no limit, so a few bytes of input take seconds to process. An attacker who can send untrusted input to such a field can tie up the server and cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pydantic affected >= 2.10.0, < 2.14.0 fixed 2.14.0

## How to check

- Check the installed version with `pip show pydantic` or `python -c "import pydantic; print(pydantic.VERSION)"`.
- Search the codebase for `Fraction` fields in Pydantic models that accept untrusted strings.

## Fix

- `pydantic` `2.14.0`: exponents larger than 4300 in absolute value are rejected.

## Timeline

- 2026-11-09T22:53:21+00:00 ghsa-repo https://github.com/pydantic/pydantic/security/advisories/GHSA-gj4f-r7mf-jjxh

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/pydantic/pydantic/security/advisories/GHSA-gj4f-r7mf-jjxh

## From the sources

### Summary

Validating an untrusted string in exponent notation into a `Fraction` field computes the full power of ten without any bound: an input of a few bytes takes seconds to validate.

### Details

String inputs are passed to the [`Fraction`](https://docs.python.org/3/library/fractions.html#fractions.Fraction) constructor. For strings in exponent notation (e.g. `'1e8000000'`), CPython computes the corresponding power of ten as an integer ([`Lib/fractions.py`](https://github.com/python/cpython/blob/v3.14.8/Lib/fractions.py#L275-L281)):

```python
exp = m.group('exp')
if exp:
    exp = int(exp)
    if exp >= 0:
        numerator *= 10**exp
    else:
        denominator *= 10**-exp
```

The issue was fixed in commit https://github.com/pydantic/pydantic/commit/69ed168e9ad465eef4c8d81efb152a93b604daf5. For strings in exponent notation, the exponent is now parsed before calling the `Fraction` constructor, and exponents larger than 4300 (in absolute value) are rejected.

### Impact

Denial of service through validation of untrusted input. Affected are applications validating untrusted strings into `Fraction` fields (in both JSON and Python mode, including in strict mode), using Pydantic from 2.10.0 up to (but excluding) 2.14.0.

From 2.14.0, exponents larger than 4300 (in absolute value) are rejected, matching the maximum number of digits accepted for integers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_