CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Attackers can cause denial of service in Pydantic AI by triggering early stream termination that leaks concurrency slots, blocking subsequent requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107286?
CVE-2026-107286 is a high-severity denial of service vulnerability in pydantic-ai, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.
Weakness: CWE-772
Which versions are affected by CVE-2026-107286?
6 open source packages ship an affected version, including pydantic-ai and pydantic-ai-slim. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pydantic-ai PyPI | From 2.10.0 | 2.53.0 |
pydantic-ai PyPI | From 2.10.0 | 2.53.0 |
pydantic-ai PyPI | From 2.10.0 | 2.53.0 |
pydantic-ai-slim PyPI | From 2.10.0 | 2.53.0 |
pydantic-ai-slim PyPI | From 2.10.0 | 2.53.0 |
pydantic-ai-slim PyPI | From 2.10.0 | 2.53.0 |
Products include Pydantic Pydantic Ai.
How do I fix CVE-2026-107286?
Upgrade pydantic-ai to 2.53.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107286 being exploited?
There is no known exploitation of CVE-2026-107286 in the wild and no public exploit code.
Other vulnerabilities in pydantic-ai
- CVE-2026-25580 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling
- CVE-2026-107295 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- CVE-2026-25640 Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL
- CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
- CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Sources
Also known as GHSA-6fqq-452j-qhrp, PYSEC-2026-4276, PYSEC-2026-4285.