Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.
CVE-2026-107286
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107286
pydantic-ai
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
pydantic-ai-slim
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "pydantic",
"product": "pydantic-ai",
"versions": [
{
"status": "affected",
"version": ">= 2.10.0, < 2.53.0"
}
]
},
{
"vendor": "pydantic",
"product": "pydantic-ai-slim",
"versions": [
{
"status": "affected",
"version": ">= 2.10.0, < 2.53.0"
}
]
}
]- Related CVEs
- CVE-2026-107286
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #13044 · Revision 1
- Added to Heist Feed
- Publisher date