Pydantic AI security advisory: fetching attacker-controlled HTML with web_fetch_tool can delay other work in the same process

Pydantic AI released security advisory GHSA-4whf-38hw-pxxh: fetching attacker-controllable HTML with web_fetch_tool can delay other work in the same process and even exhaust the process's memory. Converting a page containing a large number of HTML elements occupies a worker for a long time, and concurrent fetches can saturate a shared worker pool and delay unrelated operations; earlier affected versions also perform the conversion on the event loop; a page containing extremely large tags can make the conversion use several times the page size in memory. Exploitation requires that the application uses the tool to fetch HTML whose content an attacker can influence; the severity rating assumes the worst-case deployment, in which an unauthenticated user can prompt an agent that has web_fetch_tool and have the attacker choose the URL.