id: PYSEC-2026-1812
published: "2026-07-07T11:45:38.517274Z"
modified: "2026-07-07T17:25:10.342315Z"
aliases:
- CVE-2024-3772
- GHSA-mr82-8j83-vxmv
summary: Pydantic regular expression denial of service
details: Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
affected:
- package:
    name: pydantic
    ecosystem: PyPI
    purl: pkg:pypi/pydantic
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.10.13
    - introduced: 2.0.0
    - fixed: 2.4.0
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - "0.1"
  - "0.10"
  - "0.11"
  - 0.11.1
  - 0.11.2
  - "0.12"
  - 0.12.1
  - "0.13"
  - 0.13.1
  - "0.14"
  - "0.15"
  - "0.16"
  - 0.16.1
  - "0.17"
  - "0.18"
  - 0.18.1
  - 0.18.2
  - "0.19"
  - "0.2"
  - 0.2.1
  - "0.20"
  - 0.20.1
  - 0.20a1
  - "0.21"
  - "0.22"
  - "0.23"
  - "0.24"
  - "0.25"
  - "0.26"
  - "0.27"
  - 0.27a1
  - "0.28"
  - "0.29"
  - "0.3"
  - "0.30"
  - 0.30.1
  - "0.31"
  - 0.31.1
  - "0.32"
  - 0.32.1
  - 0.32.2
  - "0.4"
  - "0.5"
  - "0.6"
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - "0.7"
  - 0.7.1
  - "0.8"
  - "0.9"
  - 0.9.1
  - "1.0"
  - 1.0b1
  - 1.0b2
  - "1.1"
  - 1.1.1
  - 1.10.0
  - 1.10.0a1
  - 1.10.0a2
  - 1.10.0b1
  - 1.10.1
  - 1.10.10
  - 1.10.11
  - 1.10.12
  - 1.10.2
  - 1.10.3
  - 1.10.4
  - 1.10.5
  - 1.10.6
  - 1.10.7
  - 1.10.8
  - 1.10.9
  - "1.2"
  - "1.3"
  - "1.4"
  - "1.5"
  - 1.5.1
  - "1.6"
  - 1.6.1
  - 1.6.2
  - "1.7"
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - "1.8"
  - 1.8.1
  - 1.8.2
  - 1.9.0
  - 1.9.0a1
  - 1.9.0a2
  - 1.9.1
  - 1.9.2
  - "2.0"
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.1.0
  - 2.1.1
  - 2.2.0
  - 2.2.1
  - 2.3.0
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-3772
- type: WEB
  url: https://github.com/pydantic/pydantic/pull/7360
- type: WEB
  url: https://github.com/pydantic/pydantic/commit/59d8f38fd6220e3917c53785dbc70317d6f8e631
- type: WEB
  url: https://github.com/pydantic/pydantic/commit/e4393ae6145c4dadff739990bb0116c6dec3441b
- type: PACKAGE
  url: https://github.com/pydantic/pydantic
- type: WEB
  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JBZLMSH4GAZOVBMT2JUO2LXHY7M2ALI
- type: PACKAGE
  url: https://pypi.org/project/pydantic
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mr82-8j83-vxmv
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H