---
id: "GHSA-jfv7-ghgv-gx4x"
page: "https://infrastack.ai/live/GHSA-jfv7-ghgv-gx4x"
kind: "vulnerability"
aliases: ["GHSA-jfv7-ghgv-gx4x"]
title: "Quadratic time timedelta validation in Pydantic V1"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pydantic", "note": "<=1.10.27", "fixed": ["1.10.27"], "affected": "<= 1.10.27", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-1333", "package", "pydantic", "python", "web-apis"]
not_affected_if: ["no-untrusted-timedelta-input", "pydantic-v2-without-v1-namespace"]
published_at: "2026-10-29T16:46:27+00:00"
first_seen_at: "2026-11-09T22:53:21+00:00"
updated_at: "2026-11-09T22:54:35+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/pydantic/pydantic/security/advisories/GHSA-jfv7-ghgv-gx4x", "first_seen_at": "2026-11-09T22:53:21+00:00"}]
exploit_sources: []
---

# Quadratic time timedelta validation in Pydantic V1

Link for people: https://infrastack.ai/live/GHSA-jfv7-ghgv-gx4x (this .md is for agents)

Pydantic V1 parses ISO 8601 duration strings into timedelta fields with a regular expression that has an unescaped dot, so it matches digits too. A string of a few dozen kilobytes of digits makes validation take seconds, which is a denial of service for any app validating untrusted input.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pydantic affected <= 1.10.27 fixed 1.10.27

## How to check

- Check the installed Pydantic version with `pip show pydantic` or `python -c "import pydantic; print(pydantic.VERSION)"`; versions at or below `1.10.27` are affected.
- Look for `timedelta` fields fed from untrusted input, such as request bodies or query parameters.
- If you use the `pydantic.v1` namespace under Pydantic V2, check that version as well.

## Fix

- Pydantic (PyPI) V1: `1.10.27`
- Pydantic V2 users of the `pydantic.v1` namespace: `2.14.2` or later

## Timeline

- 2026-11-09T22:53:21+00:00 ghsa-repo https://github.com/pydantic/pydantic/security/advisories/GHSA-jfv7-ghgv-gx4x

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/pydantic/pydantic/security/advisories/GHSA-jfv7-ghgv-gx4x

## From the sources

### Summary

Validating an untrusted ISO 8601 duration string into a [`timedelta`](https://docs.python.org/3/library/datetime.html#datetime.timedelta) field with Pydantic V1 takes quadratic time: an input of a few dozen kilobytes takes seconds to validate.

### Details

The [`iso8601_duration_re`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/datetime_parse.py#L45) regular expression used to parse ISO 8601 durations (in [`pydantic/datetime_parse.py`](https://github.com/pydantic/pydantic/blob/v1.10.26/pydantic/datetime_parse.py)) contains an unescaped `.`, which also matches digits:

```python
iso8601_duration_re = re.compile(
    r'^(?P<sign>[-+]?)'
    r'P'
    r'(?:(?P<days>\d+(.\d+)?)D)?'
    r'(?:T'
    r'(?:(?P<hours>\d+(.\d+)?)H)?'
    r'(?:(?P<minutes>\d+(.\d+)?)M)?'
    r'(?:(?P<seconds>\d+(.\d+)?)S)?'
    r')?'
    r'$'
)
```

On a string of digits, the repeated groups overlap and the regex engine backtracks in quadratic time.

The issue was fixed in commit https://github.com/pydantic/pydantic/commit/62791e66a9f8f118e465ed760c9e2ede9ae3055e.

If you are relying on the `pydantic.v1` namespace in Pydantic V2, upgrade to [V2.14.2](https://github.com/pydantic/pydantic/releases/tag/v2.14.2) or later.

### Impact

Denial of service through validation of untrusted input. Affected are applications validating untrusted strings into [`timedelta`](https://docs.python.org/3/library/datetime.html#datetime.timedelta) fields.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_