pydantic-ai patches four security holes in its web fetch tool

pydantic-ai's v2.44.0 release closes four separate advisories, all reachable through the framework's own web_fetch tool.

Anyone running an agent with that tool enabled faced four separate ways a fetched page could turn against the process serving it. One bug let it probe internal infrastructure; another could freeze every other agent running in the same process.

The SSRF bug is the most serious of the four. The blocklist meant to keep agents off cloud metadata endpoints and private IP ranges didn't account for IPv6 zone identifiers. A crafted address could slip past it.

A second advisory is a denial-of-service path. HTML conversion and charset decoding ran with superlinear time complexity directly on the event loop, so one attacker-chosen page could stall every agent running in that process.

The other two are quieter but still real. Domain allowlist comparisons checked strings as written instead of how a resolver actually normalizes them, a bypass class of its own. And spans could carry fetched instructions and error content even when include_content=False was set, so a privacy flag wasn't fully honored in tracing output.

The release notes don't say how long the IPv6 bypass existed before anyone caught it. Update to 2.44.0, or 1.107.6 for the older line, if web_fetch is enabled anywhere in your agent stack.