{"id":"CVE-2024-3772","aliases":["GHSA-mr82-8j83-vxmv","PYSEC-2026-1812"],"title":"Pydantic regular expression denial of service","summary":"Pydantic regular expression denial of service","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"pydantic","product":"pydantic","ecosystem":"pip","affected":["pydantic >= 2.0.0, < 2.4.0","pydantic < 1.10.13"],"patched":["pydantic 2.4.0","pydantic 1.10.13"],"published":"2024-04-15","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mr82-8j83-vxmv","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3772"},{"url":"https://github.com/pydantic/pydantic/pull/7360"},{"url":"https://github.com/pydantic/pydantic/commit/59d8f38fd6220e3917c53785dbc70317d6f8e631"},{"url":"https://github.com/pydantic/pydantic/commit/e4393ae6145c4dadff739990bb0116c6dec3441b"},{"url":"https://github.com/pydantic/pydantic"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JBZLMSH4GAZOVBMT2JUO2LXHY7M2ALI"}],"tags":["osv","pip"],"epss":0.00957,"epssPercentile":0.59944,"ingestedAt":"2026-07-08T18:25:51.427Z","slug":"CVE-2024-3772","body":"## Overview\n\nRegular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.\n\n## Affected packages\n\n- `pydantic >= 2.0.0, < 2.4.0`\n- `pydantic < 1.10.13`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pydantic 2.4.0`\n- `pydantic 1.10.13`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}