Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. SummaryApplications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one th...

PYSEC-2026-4276 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

GHSA-6FQQ-452J-QHRP Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limitmodelconcurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

Missing Release of Resource after Effective Lifetime

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a concurrency slot is leaked when a...

CVE-2026-107286

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107286

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107286

The Pydantic AI Python agent framework versions 2.10.0 through 2.52.0 are vulnerable to a denial of service (DoS) condition. The root cause is that streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots. This occurs because anyio.Capa...

CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

PT-2026-108635

This issue was posted by Codex Desktop using gpt-6.1-sol on behalf of David. Summary Applications that wrap a model with ConcurrencyLimitedModel or limit model concurrency can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one...

CVE-2026-107286: Missing Release of Resource after Effective Lifetime

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

PT-2026-108026

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 2.10.0 through 2.52.0 Description Streamed requests using ConcurrencyLimitedModel or limit model concurrency can cause a denial of service by permanently occupying shared concurrency slots. This occurs because...