What is CVE-2021-29510?

CVE-2021-29510 is a low-severity vulnerability in Pydantic, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 3.3/10. Published 2021-05-13.

How severe is CVE-2021-29510?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Pydantic

CVE-2021-29510

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

Published 2021-05-13 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.010 (61.4th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 61.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000

Affected products

Pydantic
Samuelcolvin Pydantic — versions >= 1.8.0, < 1.8.2, >= 1.7.0, < 1.7.4, < 1.6.2
Fedoraproject Fedora — versions 33, 34

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh (Patch, Third Party Advisory, Mitigation)
github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468 (Patch, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)

Frequently asked questions

What is CVE-2021-29510?: CVE-2021-29510 is a low-severity vulnerability in Pydantic, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 3.3/10. Published 2021-05-13.
How severe is CVE-2021-29510?: Low severity. CVSS v3 base score is 3.3 out of 10.