CVE-2021-29510: Pydantic - Denial of Service (DoS) via Infinite Loop
Summary
CVE-2021-29510: Pydantic is a data validation and settings management using Python type hinting. Affects pydantic across 4 version ranges.
< 1.6.2
>= 1.7, < 1.7.4
>= 1.8, < 1.8.2
< 7e83fdd2563ffac081db7ecdf1affa65ef38c468
Fixed in 1.6.2, 1.7.4 or 1.8.2, depending on the release line you run. How to fix ↓
Also tracked for
- pydantic · Debian:11
The same CVE-2021-29510 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic is a Python library used for data validation and settings management. It leverages Python type hinting to provide robust data validation capabilities. The library is widely used in various Python applications and frameworks. However, certain versions of Pydantic are vulnerable to a Denial of Service (DoS) attack that can be triggered by passing specific values to datetime or date fields. This vulnerability can lead to an infinite loop, causing 100% CPU usage on one CPU core. Pydantic versions 1.8.x, 1.7.x, and 1.6.x are affected by this issue.
Vulnerability Detail
The vulnerability in Pydantic arises when 'infinity', 'inf', float('inf'), or their negatives are passed to datetime or date fields. When these values are encountered, the validation process enters an infinite loop, consuming excessive CPU resources. This can result in a Denial of Service (DoS) condition, impacting the availability of the affected application. The vulnerability has been assigned CVE-2021-29510 and has been addressed in Pydantic versions 1.8.2, 1.7.4, and 1.6.2.
How To Fix
Latest published version: 2.14.1 as of 23 Oct 2026
pip install --upgrade "pydantic==2.14.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.21.6.2pip install --upgrade "pydantic==1.6.2" -
>= 1.7, < 1.7.41.7.4pip install --upgrade "pydantic==1.7.4" -
>= 1.8, < 1.8.21.8.2pip install --upgrade "pydantic==1.8.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Pydantic is not immediately feasible, a temporary workaround can be implemented using a validator to catch the problematic values. The Pydantic documentation provides guidance on using validators (https://pydantic-docs.helpmanual.io/usage/validators/). However, it is important to note that this workaround is not ideal and upgrading to a fixed version of Pydantic is strongly recommended.
Conclusion
The vulnerability in Pydantic can be mitigated by upgrading to one of the fixed versions: v1.8.2, v1.7.4, or v1.6.2. It is important to promptly address this issue to prevent potential Denial of Service (DoS) attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pydantic →
FAQ
Pydantic is a Python library used for data validation and settings management. It leverages Python type hinting to provide robust data validation capabilities.
The vulnerability allows an attacker to trigger an infinite loop in Pydantic, leading to 100% CPU usage on one CPU core. This can result in a Denial of Service (DoS) condition, impacting the availability of the affected application.
Pydantic versions 1.8.x, 1.7.x, and 1.6.x are affected by this vulnerability.
To fix the vulnerability, it is recommended to upgrade Pydantic to one of the patched versions: v1.8.2, v1.7.4, or v1.6.2.
A temporary workaround can be implemented using a validator to catch the problematic values. However, upgrading to a fixed version of Pydantic is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic.
