Pydantic AI 2.44.0 ships four security fixes covering the web_fetch tool and OpenTelemetry spans

Pydantic AI 2.44.0 shipped on 16 September, with four security advisories fixed in the same release. Pydantic ports the same fixes to 1.107.6 on the v1 branch. Three of the four sit in the web_fetch code path, and the fourth is in the OpenTelemetry span code. The repository lists 20,000 stars and 2,700 forks at the time of the release.

The two moderate advisories

GHSA-vmxc-h2x2-jmf3 covers a bypass of the cloud-metadata and private-IP blocklists. Pydantic writes that "the cloud-metadata and private-IP blocklists could be bypassed with an IPv6 zone identifier on a URL opted into local network access, via FileUrl(force_download='allow-local') or web_fetch_tool(allow_local_urls=True)". Both settings are off by default, so a caller had to have explicitly turned on local network access to be exposed. Credited to @euriconicacio.

GHSA-fpf4-vwcp-v4hp covers a stall attack on the shared event loop. Pydantic writes that web_fetch processed responses in "superlinear time on the event loop", which meant a malicious page could freeze every agent in the same process by returning HTML or a charset that took a long time to decode. Default configurations are affected.

The two low advisories

GHSA-22h6-qm39-v87j covers the domain blocklist. Pydantic writes that domains were compared "as written rather than in resolver format", so a caller could reach a blocked domain by writing it in a different form. Default configurations are affected.

GHSA-4x9p-g9wm-8q7f covers the OpenTelemetry instrumentation. Pydantic writes that with InstrumentationSettings(include_content=False) set, "spans still carried exceptions, error statuses, instructions and the output template". Any team relying on that flag to keep prompts and outputs out of a shared observability backend was not getting the redaction they thought they were getting. Default configurations are affected.

Non-security changes

The same release stabilises the serialised shape of AgentRunResult, adds an Agent.from_spec() constructor that no longer requires a model up front, adds a storage documentation page, and adds a migration skill for the Vercel AI SDK and Eve. The changelog also lists fixes to realtime sessions, tool handling, and span reporting.

What a team should do

The two low advisories are the ones easy to underestimate. The domain-blocklist mismatch is the shape of hole that survives every unit test written in English, because the string that the test asserts and the string that the resolver produces are close enough that only one of them appears in the fixture. The OpenTelemetry leak is the sort of thing a compliance review usually accepts on trust, on the strength of the flag name; every trace already in the backend from a running agent needs to be checked against the actual span content, not the expected content.

The upgrade is one line for a team on 2.x. A team on the v1 branch takes the fix from 1.107.6 instead. Pydantic is not blocking on a specific severity threshold, so both patches are worth taking at the same cadence.

Source

Primary source: pydantic/pydantic-ai v2.44.0 release notes, on GitHub, 16 September 2026.