CVE-2026-107286High· 7.5▾ TwilightPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.
pydantic_ai >= 2.10.0, < 2.53.0Upgrade past the affected range:
pydantic_ai 2.53.0Affected packages:
pydantic-ai >= 2.10.0, < 2.53.0pydantic-ai-slim >= 2.10.0, < 2.53.0Patched in:
pydantic-ai 2.53.0pydantic-ai-slim 2.53.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107295High· 7.6Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107293Medium· 5.3Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107294Medium· 6.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107292Medium· 6.4Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107290Medium· 6.5Pydantic AI is a Python agent framework for building applications and workflows with Generative AI
CVE-2026-107291Medium· 4.3Pydantic AI is a Python agent framework for building applications and workflows with Generative AI