CVE-2026-107286: Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Applications that wrap a model with ConcurrencyLimitedModel or limit_model_concurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one that acquired it. This can happen when a stream ends early, and also when a stream is fully consumed using the default stream_text() debouncing.
In an application that exposes an affected streaming endpoint to network clients and shares a long-lived model limiter across requests, a client can repeatedly start a stream and disconnect. The completed requests retain their slots, eventually preventing subsequent requests that share the limiter from proceeding.
Agent-level max_concurrency and non-streaming model requests are not affected by this defect.
References
- github.com/advisories/GHSA-6fqq-452j-qhrp
- github.com/pydantic/pydantic-ai/commit/453f19feeb7ab1d789f9393b1723c6a73b3d77b2
- github.com/pydantic/pydantic-ai/pull/9478
- github.com/pydantic/pydantic-ai/releases/tag/v2.53.0
- github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp
- nvd.nist.gov/vuln/detail/CVE-2026-107286
Code Behaviors & Features
Detect and mitigate CVE-2026-107286 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →