Skip to content
OpenAdvisories
Medium · 5.9 CVE-2024-3772 EUVD-2024-1252GHSA-mr82-8j83-vxmvPYSEC-2026-1812

Regular expression denial of service in Pydantic < 2.4.0

Published Apr 15, 2024 · Updated Feb 13, 2025 · Assigned by directcyber

Vendor: pydantic Product: Pydantic Package: pydantic Package: pydantic Package: pydantic Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

Affected products

VendorProductAffectedFixed
Pydantic Pydantic 2.0 – < 2.4.0, 1.0 – < 1.10.13 2.4.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 pydantic 1.10.13-0.1 —
Debian 13 pydantic 1.10.13-0.1 —
Debian 12 pydantic 1.10.4-1+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS pydantic 1.8.2-1ubuntu0.1~esm1 USN-7101-1
Ubuntu Pro 20.04 LTS pydantic 1.2-1ubuntu0.1~esm3 USN-7101-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ansible Automation Platform Inside 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-controller-venv-tower 4.5.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-hub +2 4.9.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-aiohttp +1 3.9.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-galaxy-ng +1 4.9.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-gunicorn +1 22.0.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pillow +1 10.3.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pydantic +1 1.10.15-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-social-auth-app-django +1 5.4.1-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-sqlparse +1 0.5.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-aiohttp +1 3.9.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-gunicorn +1 22.0.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pillow +1 10.3.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pydantic +1 1.10.15-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-social-auth-app-django +1 5.4.1-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-sqlparse +1 0.5.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 python-pydantic 1.10.8-150400.9.10.1 SUSE-SU-2025:0310-1
SLES 3 python-pydantic 1.10.8-150400.9.10.1 SUSE-SU-2025:0310-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-pydantic 2.13.4-2.1 openSUSE-SU-2026:11424-1
openSUSE Leap 15.6 python-pydantic 1.10.8-150400.9.10.1 SUSE-SU-2025:0310-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pydantic >= 2.0.0, < 2.4.0 2.4.0 GHSA-mr82-8j83-vxmv
PyPI pydantic < 1.10.13 1.10.13 GHSA-mr82-8j83-vxmv
PyPI pydantic < 1.10.13 · >= 2.0.0, < 2.4.0 1.10.13, 2.4.0 PYSEC-2026-1812

Advisories 6

References