PYDANTIC · GHSA-jfv7-ghgv-gx4x · Package
FIX → 1.10.27
Pydantic V1 parses ISO 8601 duration strings into timedelta fields with a regular expression that has an unescaped dot, so it matches digits too. A string of a few dozen kilobytes of digits makes validation take seconds, which is a denial of service for any app validating untrusted input.
first public Oct 29, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that parse untrusted ISO 8601 duration strings into timedelta fields using Pydantic V1, or the pydantic.v1 namespace in Pydantic V2. Services that only handle trusted internal data, or that do not accept timedelta values from users, are not exposed.
Not affected if no-untrusted-timedelta-input, pydantic-v2-without-v1-namespace
Who cares pydantic, python, web-apis
pip show pydantic or python -c "import pydantic; print(pydantic.VERSION)"; versions at or below 1.10.27 are affected.timedelta fields fed from untrusted input, such as request bodies or query parameters.pydantic.v1 namespace under Pydantic V2, check that version as well.Validating an untrusted ISO 8601 duration string into a timedelta field with Pydantic V1 takes quadratic time: an input of a few dozen kilobytes takes seconds to validate.
The iso8601_duration_re regular expression used to parse ISO 8601 durations (in pydantic/datetime_parse.py) contains an unescaped ., which also matches digits:
iso8601_duration_re = re.compile(
r'^(?P<sign>[-+]?)'
r'P'
r'(?:(?P<days>\d+(.\d+)?)D)?'
r'(?:T'
r'(?:(?P<hours>\d+(.\d+)?)H)?'
r'(?:(?P<minutes>\d+(.\d+)?)M)?'
r'(?:(?P<seconds>\d+(.\d+)?)S)?'
r')?'
r'$'
)
On a string of digits, the repeated groups overlap and the regex engine backtracks in quadratic time.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.10.27
1.10.27pydantic.v1 namespace: 2.14.2 or laterThe issue was fixed in commit https://github.com/pydantic/pydantic/commit/62791e66a9f8f118e465ed760c9e2ede9ae3055e.
If you are relying on the pydantic.v1 namespace in Pydantic V2, upgrade to V2.14.2 or later.
Denial of service through validation of untrusted input. Affected are applications validating untrusted strings into timedelta fields.