https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:47:22.505498+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2021-04697 bdu:2021-04697 2026-10-03T20:47:22.665579+00:00 bdu:2021-04697 https://cve.radiocsirt.org/vuln/brew-pydantic-cve-2021-29510 BREW-pydantic-CVE-2021-29510 — Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic 2026-10-03T20:47:22.665626+00:00

Affected: Homebrew: pydantic

Impact

Passing either 'infinity', 'inf' or float('inf') (or their negatives) to datetime or date fields causes validation to run forever with 100% CPU usage (on one CPU). Patches

Pydantic is be patched with fixes available in the following versions:

v1.8.2 v1.7.4 v1.6.2

All these versions are available on pypi, and will be available on conda-forge soon.

See the changelog for details. Workarounds

If you absolutely can't upgrade, you can work around this risk using a validator to catch these values, brief demo:

from datetime import date from pydantic import BaseModel, validator

class DemoModel(BaseModel): date_of_birth: date

@validator('date_of_birth', pre=True) def skip_infinite_values(cls, v): try: seconds = float(v) except (ValueError, TypeError): return v else: if seconds == float('inf'): return date.max elif seconds == float('-inf'): return date.min else: return seconds

Note: this is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic.

If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. References

This was fixed in commit 7e83fdd.

 https://cve.radiocsirt.org/vuln/euvd-2026-26401 EUVD-2026-26401 2026-10-03T20:47:22.665719+00:00 EUVD-2026-26401 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29510 fkie_cve-2021-29510 2026-10-03T20:47:22.665744+00:00

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

 https://cve.radiocsirt.org/vuln/ghsa-5jqp-qgf6-3pvh GHSA-5jqp-qgf6-3pvh — Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic 2026-10-03T20:47:22.665795+00:00

Affected: PyPI: pydantic

Impact

Passing either 'infinity', 'inf' or float('inf') (or their negatives) to datetime or date fields causes validation to run forever with 100% CPU usage (on one CPU). Patches

Pydantic is be patched with fixes available in the following versions:

v1.8.2 v1.7.4 v1.6.2

All these versions are available on pypi, and will be available on conda-forge soon.

See the changelog for details. Workarounds

If you absolutely can't upgrade, you can work around this risk using a validator to catch these values, brief demo:

from datetime import date from pydantic import BaseModel, validator

class DemoModel(BaseModel): date_of_birth: date

@validator('date_of_birth', pre=True) def skip_infinite_values(cls, v): try: seconds = float(v) except (ValueError, TypeError): return v else: if seconds == float('inf'): return date.max elif seconds == float('-inf'): return date.min else: return seconds

Note: this is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic.

If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. References

This was fixed in commit 7e83fdd.

 https://cve.radiocsirt.org/vuln/gsd-2021-29510 gsd-2021-29510 2026-10-03T20:47:22.665862+00:00 gsd-2021-29510 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11254-1 openSUSE-SU-2024:11254-1 — python36-pydantic-1.8.2-1.2 on GA media 2026-10-03T20:47:22.665884+00:00

python36-pydantic-1.8.2-1.2 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2021-47 PYSEC-2021-47 2026-10-03T20:47:22.665916+00:00

Affected: PyPI: pydantic

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29510 UBUNTU-CVE-2021-29510 2026-10-03T20:47:22.665971+00:00

Affected: Ubuntu:Pro:20.04:LTS: pydantic

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.