# CVE-2026-107286: Pydantic AI concurrency slot leak in streamed requests

Source: https://junglewise.ai/threats/cve-2026-107286-pydantic-ai-concurrency-limited-models-can-keep-their-slot-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107286 · Severity: high · CVSS 7.5 · Published 2026-10-08

Pydantic AI's concurrency limiting feature can permanently consume connection slots when a client starts and disconnects from a stream request. A remote attacker can exploit this by repeatedly connecting and disconnecting from a streaming endpoint, eventually exhausting all available connection capacity and preventing legitimate users from accessing the service.

Technologies: [Pydantic AI](https://junglewise.ai/threats/technologies/pydantic-pydantic-ai), [pydantic-ai (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai), [pydantic-ai-slim (PyPI)](https://junglewise.ai/threats/technologies/pydantic-ai-slim). Vendors: [Pydantic](https://junglewise.ai/threats/vendors/pydantic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107286 being exploited in the wild.

**How severe is CVE-2026-107286?** High severity, with a CVSS score of 7.5, published 8 October 2026.

**Which products and versions are affected?** Pydantic AI all versions before the fix; pydantic-ai (PyPI) >= 2.10.0, < 2.53.0, ECOSYSTEM:introduced=2.10.0,fixed=2.53.0; pydantic-ai-slim (PyPI) >= 2.10.0, < 2.53.0, ECOSYSTEM:introduced=2.10.0,fixed=2.53.0.

**Is there a fix for CVE-2026-107286?** Yes. pydantic-ai (PyPI): upgrade to 2.53.0 or later; pydantic-ai-slim (PyPI): upgrade to 2.53.0 or later. Until then: If you cannot upgrade immediately, use agent-level max_concurrency setting instead of ConcurrencyLimitedModel, or avoid streaming requests through a concurrency-limited model. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107286 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107286?** Check whether you run Pydantic AI, pydantic-ai (PyPI) or pydantic-ai-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pydantic-ai (PyPI): upgrade to 2.53.0 or later

  ```sh
  pip install "pydantic-ai>=2.53.0"
  ```

- pydantic-ai-slim (PyPI): upgrade to 2.53.0 or later

  ```sh
  pip install "pydantic-ai-slim>=2.53.0"
  ```


If you cannot upgrade immediately, use agent-level max_concurrency setting instead of ConcurrencyLimitedModel, or avoid streaming requests through a concurrency-limited model.

## Technical details

When a streamed request is released from a different task than the one that acquired its concurrency slot, the underlying anyio.CapacityLimiter rejects the release and the slot remains occupied. This occurs during early stream termination, consumer exceptions, cancellation, and also when fully consuming a stream with the default debounce_by=0.1 setting. The issue affects applications that expose streaming endpoints to network clients while sharing a long-lived ConcurrencyLimitedModel or limit_model_concurrency wrapper across requests.

## Affected products

- Pydantic pydantic-ai all versions before the fix

## Identifiers

- CVE-2026-107286
- GHSA-6fqq-452j-qhrp
- PYSEC-2026-4276
- PYSEC-2026-4285

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Pydantic AI excessive resource consumption in HTML-to-Markdown conversion](https://junglewise.ai/threats/cve-2026-107287-pydantic-ai-excessive-resource-use-when-local-web-fetching)
- [Pydantic AI web chat UI Host header validation bypass](https://junglewise.ai/threats/cve-2026-107292-pydantic-ai-web-chat-ui-agent-to-web-clai-web-the-local-chat)
- [Pydantic AI missing content-type validation in chat endpoint](https://junglewise.ai/threats/cve-2026-107295-pydantic-ai-web-chat-ui-agent-to-web-clai-web-a-website-visited)
- [Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`](https://junglewise.ai/threats/cve-2026-107293-pydantic-ai-opentelemetry-instrumentation-retry-prompt-content)
- [Pydantic AI unbounded memory use in remote content download](https://junglewise.ai/threats/cve-2026-107294-pydantic-ai-unbounded-memory-use-when-downloading-remote-content)