CVE-2024-3772 is a medium severity vulnerability (CVSS 5.9) in Pydantic. A crafted email string can trigger a regular expression denial of service in Pydantic. Upgrade to Pydantic 2.4.0 or later, or 1.10.13 or later on the 1.x line, based on the version ranges in the record.
What's affected
- Pydantic before 2.4.0 on the 2.x line.
- Pydantic before 1.10.13 on the 1.x line.
- The record also lists Fedora 38 packages as affected.
Severity in the record: Medium, CVSS 5.9, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-1333, inefficient regular expression complexity.
Fixed version: Upgrade to Pydantic 2.4.0 or later, or 1.10.13 or later on the 1.x line, based on the version ranges in the record. Confirm in the linked pull request.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Show the installed version:
pip show pydantic. - List it across a project:
pip list | grep -i pydantic. - Check lockfiles for pinned versions:
grep -i pydantic requirements.txt poetry.lock.
You can also paste a dependency manifest into the free in-browser dependency scan to see which known CVEs your libraries carry. That helps for packages such as Pydantic or Qdrant clients, while self-hosted applications are best tracked in an inventory by hand.
What to do now
- Upgrade to a fixed release.
- Limit the length of email strings you accept before they reach validation.
- Put request timeouts on any endpoint that validates user supplied email addresses.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3772.
Why it matters
Some regular expressions take far longer on certain inputs than on normal ones. When a pattern is applied to untrusted text, a short crafted string can keep a CPU busy for a long time, which is a denial of service with very little effort. The usual fixes are a rewritten pattern, an input length limit, or a regex engine that guarantees linear time.
The weakness is in how email strings are validated. Applications that accept an email field through a Pydantic model, which includes most FastAPI services with user input, are the likely exposure. The record scores the issue as Medium, reflecting that the impact is availability only. The effect is real for services with few workers, since one slow request can hold a worker.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I exposed if I use Pydantic but never validate email addresses?
The record ties the issue to a crafted email string. If no model in your code validates email, the vulnerable path is likely not reached, but upgrading is still cheap.
Is CVE-2024-3772 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
