CVE-2026-107286— Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Quick assessment
Affected
pydantic pydantic-ai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pydantic AI 是一个用于构建生成式 AI 应用和流程的 Python 代理框架。在版本 2.10.0 至 2.53.0 之间，通过 ConcurrencyLimitedModel 或 limit_model_concurrency 发起的流式请求可能会保留共享的并发配额（slots）。这是因为 anyio.CapacityLimiter 将已获取的配额与借用该配额的“任务”关联，而流式清理操作可能在另一个不同的任务中执行。因此，早期终止流、取消操作、消费者端异常，或者在使用 debounce_by=0.1
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107286
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Source: CVE Program / CVE List V5
Vulnerability Description
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pydantic | pydantic-ai | >= 2.10.0, < 2.53.0 | - |
|
| pydantic | pydantic-ai-slim | >= 2.10.0, < 2.53.0 | - |
|
II. Public POCs for CVE-2026-107286
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107286
请登录查看更多情报信息。
Other References for CVE-2026-107286 (4)
-
https://github.com/pydantic/pydantic-ai/pull/9478 x_refsource_MISC
-
https://github.com/pydantic/pydantic-ai/releases/tag/v2.53.0 x_refsource_MISC
-
https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp x_refsource_CONFIRM
Same Patch Batch · pydantic · 2026-10-08 · 10 CVEs total
| CVE-2026-107295 | 7.6 HIGH | `pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that ca |
| CVE-2026-107289 | 6.8 MEDIUM | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix |
| CVE-2026-107287 | 6.5 MEDIUM | Pydantic AI: Excessive resource use when local web fetching converts nested HTML |
| CVE-2026-107290 | 6.5 MEDIUM | Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` |
| CVE-2026-107294 | 6.5 MEDIUM | Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl |
| CVE-2026-107292 | 6.4 MEDIUM | Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not v |
| CVE-2026-107288 | 3.7 LOW | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes |
| CVE-2026-107291 | 2.3 LOW | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans in |
| CVE-2026-107293 | 2.3 LOW | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `incl |
IV. Related Vulnerabilities
Same product: pydantic-ai
-
CVE-2026-107295
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple -
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote co -
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt cont -
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the -
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events
Same vendor: pydantic
-
CVE-2026-107295
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple -
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote co -
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt cont -
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the -
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events
Same weakness: CWE-772
-
CVE-2026-104045
Sssd: sssd: denial of service via race condition in autofs r -
CVE-2026-104035
Sssd: sssd: denial of service via memory exhaustion in kcm r -
CVE-2026-104031
Sssd: sssd: denial of service via memory exhaustion in autof -
CVE-2026-97686
VxWorks 7 Memory Resource leak -
CVE-2026-79677
Apache Tomcat: WebSocket DoS due to lost asynchronous write
V. Comments for CVE-2026-107286
No comments yet