PyPI/pydantic-ai CVE-2026-107286: high 7.5, EPSS 0.45%

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

Action: Upgrade pydantic-ai to 2.53.0 or later.

pip install pydantic-ai==2.53.0

Affected

Fixed versions

Sources

• osv: GHSA-6fqq-452j-qhrp
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp
• https://nvd.nist.gov/vuln/detail/CVE-2026-107286
• https://github.com/pydantic/pydantic-ai/pull/9478
• https://github.com/pydantic/pydantic-ai/commit/453f19feeb7ab1d789f9393b1723c6a73b3d77b2
• https://github.com/pydantic/pydantic-ai
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.53.0

CVE-2026-107286 · published 2026-10-08T19:42:55Z · modified 2026-10-15T14:55:42.276272043Z · JSON