security: CVE-2024-3772 - pydantic - ReDoS via email validation in archastro-sdk

[calvin-archastro]

CVE-2024-3772 — pydantic ReDoS via email validation

CVE: CVE-2024-3772
Advisory: GHSA-mr82-8j83-vxmv

---

Package

• Package: pydantic (PyPI)
• Current constraint: pydantic>=2.0 (in pyproject.toml)
• Vulnerable range: >=2.0.0,<2.4.0 (also <1.10.13)
• Fixed version: 2.4.0
• Severity: MODERATE (CVSS 3.1: 5.9, High AC)

---

Impact

Regular expression denial of service in pydantic affects the email string validator (using Python's re module). An attacker supplying a crafted email string can cause significant CPU consumption. This only affects code that uses pydantic's built-in email validation (EmailStr, email-validator integration).

The constraint pydantic>=2.0 in pyproject.toml allows users of this SDK to install pydantic 2.0.x–2.3.x, all of which are vulnerable. Modern installs will resolve to >=2.4.0 automatically since 2.4.0 was released September 2023, but the constraint does not enforce it.

---

Affected Code

• pyproject.toml — "pydantic>=2.0"
• src/archastro/platform/types/*.py — uses Pydantic models for API type definitions

Note: Code search was rate-limited. Manual verification needed to confirm whether EmailStr or any email-field validators are used in the SDK models. If email validation is not used, the exploitable code path is not present and risk is very low.

---

Triage Reasoning

Escalating because:

1. This is a published SDK — the constraint bounds downstream consumers. Tightening to pydantic>=2.4.0 protects them.
2. Need human verification of whether EmailStr is used anywhere in the Pydantic models

---

Recommended Action

1. Verify whether EmailStr or email-related validators appear in src/archastro/platform/types/*.py
   • If not used: the risk is noise; document the decision and tighten the constraint as a housekeeping item
   • If used: tighten constraint immediately and publish a patch release
2. Update pyproject.toml: pydantic>=2.0 → pydantic>=2.4.0
3. Publish a new version of archastro-sdk

---

Mitigations in Place

• The vulnerability only affects email validation; if the SDK does not validate email strings via pydantic, there is no exploitable code path
• Modern pip resolves to pydantic>=2.4.0 by default (current latest is significantly newer)
• CVSS 3.1 AC:H — requires a specifically crafted email input, not trivial

---

Filed by Security Triage Agent — scheduled scan 2026-05-16T22:00:00Z