PT-2021-4109 · Pypi+2 · Pydantic+2

Bluetech + 1 · Published 2021-05-01 · Updated 2025-12-08 · CVE-2021-29510

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pydantic versions prior to v1.6.2 Pydantic versions prior to v1.7.4 Pydantic versions prior to v1.8.2

Description The issue is related to the incorrect handling of 'infinity', 'inf', and float('inf') values in date fields, causing validation to run forever with 100% CPU usage. Passing either 'infinity', 'inf', or float('inf') (or their negatives) to datetime or date fields can lead to this problem.

Recommendations For versions prior to v1.6.2, upgrade to v1.6.2 or later. For versions prior to v1.7.4, upgrade to v1.7.4 or later. For versions prior to v1.8.2, upgrade to v1.8.2 or later. As a temporary workaround, consider using a validator to catch these values, such as the skip infinite values function, to prevent infinite validation. However, upgrading Pydantic to a fixed version is the recommended solution. If you are not using v1.8.x, v1.7.x, or v1.6.x and are unable to upgrade to a fixed version of Pydantic, please create an issue requesting a back-port.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2021-04697

CVE-2021-29510

GHSA-5JQP-QGF6-3PVH

OPENSUSE-SU-2024:11254-1

OPENSUSE-SU-2024:13869-1

PYSEC-2021-47

USN-6553-1

Affected Products

Linuxmint

Pydantic

Ubuntu

References · 29

• https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh · Patch
• https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UEFWM7DYKD2ZHE7R5YT5EQWJPV4ZKYRB · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5jqp-qgf6-3pvh · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-47 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/S2HT266L6Q7H6ICP7DFGXOGBJHNNKMKB · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMKAJX4O6IGBBCE32CO2G7PZQCCQSBLV · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29510 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UMKAJX4O6IGBBCE32CO2G7PZQCCQSBLV · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-29510 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6553-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29510 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEFWM7DYKD2ZHE7R5YT5EQWJPV4ZKYRB · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6553-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29510 · Vendor Advisory