CVE-2026-107286: Pydantic AI stream slot leak enables

Q: Is CVE-2026-107286 actively exploited?

No confirmed active exploitation of CVE-2026-107286 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-107286?

1) Upgrade pydantic-ai and pydantic-ai-slim to 2.53.0 or later. 2) Inventory deployments with `pip show pydantic-ai pydantic-ai-slim` and check for ConcurrencyLimitedModel or limit_model_concurrency usage in code. 3) Until patched, use non-streaming requests or agent-level max_concurrency, which are not affected. 4) Avoid debounce_by=0.1 on stream_text() for limited models. 5) Add edge rate limiting and per-client connection limits on streaming endpoints. 6) Monitor for rising in-flight request counts, growing latency or queue depth, and requests that hang with no upstream LLM calls. 7) Add health checks and automatic restarts as a temporary stopgap.

Q: What systems are affected by CVE-2026-107286?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM streaming APIs, Model serving gateways, Chat assistant backends.

Q: What is the CVSS score for CVE-2026-107286?

CVE-2026-107286 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.45%.

CISO Take

Pydantic AI versions 2.10.0 through 2.52.x leak shared concurrency slots when streamed model requests are cancelled, terminated early, or fully consumed with debounce_by=0.1. An unauthenticated remote client can trigger this over the network with low complexity, so any service that exposes streaming endpoints backed by a long-lived limiter can be starved until it stops serving requests. Exploitation is not yet evidenced: the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable. Still, the package has 485 downstream dependents and 15 other CVEs, and an availability-only impact of CVSS 7.5 is a real risk for customer-facing agents. Upgrade pydantic-ai and pydantic-ai-slim to 2.53.0 or later, and prioritize internet-facing streaming agents first.

Sources:NVDGitHub AdvisoryATLASgithub.com/pydantic/pydantic-ai

What is the risk?

High severity (CVSS 7.5), availability impact only, with no confidentiality or integrity impact. The attack is network-reachable, needs no privileges or user interaction, and has low complexity. Exploitation in the wild is unconfirmed (not in KEV, no public exploit, no EPSS score). Exposure is limited to deployments that use ConcurrencyLimitedModel or limit_model_concurrency with streaming; agent-level max_concurrency and non-streaming requests are unaffected. The leak can also happen without an attacker, through ordinary client disconnects, which makes accidental outages likely.

How does the attack unfold?

Initial Access

Attacker reaches a public streaming endpoint backed by a Pydantic AI agent that uses a shared concurrency limiter.

AML.T0049

Exploitation

Attacker opens streaming requests and cancels or terminates them early so cleanup runs in a different task and the slot is never released.

AML.T0029

Impact

Shared capacity is exhausted, so legitimate requests stall and the AI service is denied until restart.

AML.T0029

Initial Access

Attacker reaches a public streaming endpoint backed by a Pydantic AI agent that uses a shared concurrency limiter.

AML.T0049

Exploitation

Attacker opens streaming requests and cancels or terminates them early so cleanup runs in a different task and the slot is never released.

AML.T0029

Impact

Shared capacity is exhausted, so legitimate requests stall and the AI service is denied until restart.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Pydantic AI	pip	>= 2.10.0, < 2.53.0	`2.53.0`
20.8K505 dependentsPushed 6d ago94% patched~70d to patchFull package profile →
Pydantic AI	pip	>= 2.10.0, < 2.53.0	`2.53.0`
20.8K505 dependentsPushed 6d ago94% patched~70d to patchFull package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade pydantic-ai and pydantic-ai-slim to 2.53.0 or later. 2) Inventory deployments with pip show pydantic-ai pydantic-ai-slim and check for ConcurrencyLimitedModel or limit_model_concurrency usage in code. 3) Until patched, use non-streaming requests or agent-level max_concurrency, which are not affected. 4) Avoid debounce_by=0.1 on stream_text() for limited models. 5) Add edge rate limiting and per-client connection limits on streaming endpoints. 6) Monitor for rising in-flight request counts, growing latency or queue depth, and requests that hang with no upstream LLM calls. 7) Add health checks and automatic restarts as a temporary stopgap.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAgentAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage AI system resilience

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-107286?

Pydantic AI versions 2.10.0 through 2.52.x leak shared concurrency slots when streamed model requests are cancelled, terminated early, or fully consumed with debounce_by=0.1. An unauthenticated remote client can trigger this over the network with low complexity, so any service that exposes streaming endpoints backed by a long-lived limiter can be starved until it stops serving requests. Exploitation is not yet evidenced: the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and EPSS data is unavailable. Still, the package has 485 downstream dependents and 15 other CVEs, and an availability-only impact of CVSS 7.5 is a real risk for customer-facing agents. Upgrade pydantic-ai and pydantic-ai-slim to 2.53.0 or later, and prioritize internet-facing streaming agents first.

Is CVE-2026-107286 actively exploited?

No confirmed active exploitation of CVE-2026-107286 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107286?

1) Upgrade pydantic-ai and pydantic-ai-slim to 2.53.0 or later. 2) Inventory deployments with `pip show pydantic-ai pydantic-ai-slim` and check for ConcurrencyLimitedModel or limit_model_concurrency usage in code. 3) Until patched, use non-streaming requests or agent-level max_concurrency, which are not affected. 4) Avoid debounce_by=0.1 on stream_text() for limited models. 5) Add edge rate limiting and per-client connection limits on streaming endpoints. 6) Monitor for rising in-flight request counts, growing latency or queue depth, and requests that hang with no upstream LLM calls. 7) Add health checks and automatic restarts as a temporary stopgap.

What systems are affected by CVE-2026-107286?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM streaming APIs, Model serving gateways, Chat assistant backends.

What is the CVSS score for CVE-2026-107286?

CVE-2026-107286 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM streaming APIsModel serving gatewaysChat assistant backends

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.

Exploitation Scenario

An attacker finds a public chatbot endpoint that streams responses from a Pydantic AI agent protected by a shared concurrency limiter. They open many streaming requests and drop the connections after the first few tokens, or cancel them repeatedly. Each aborted stream leaves its slot held in the shared limiter. After the configured capacity is used up, legitimate users' requests queue indefinitely and the service stops responding until it is restarted. The attack needs only a simple script and no credentials.

Weaknesses (CWE)

CWE-772Missing Release of Resource after Effective LifetimePrimary CWE-772Missing Release of Resource after Effective LifetimePrimary CWE-772Missing Release of Resource after Effective Lifetime

CWE-772 — Missing Release of Resource after Effective Lifetime: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
[Implementation] It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including error conditions.

Source: MITRE CWE corpus.