CVE-2026-107286

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Missing Release of Resource after Effective Lifetime pada pydantic ai. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream termination, cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. This issue is fixed in version 2.53.0.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pydantic/pydantic-ai/pull/9478 patch · advisory vendor
• https://github.com/pydantic/pydantic-ai/releases/tag/v2.53.0 patch · release notes · advisory vendor
• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-6fqq-452j-qhrp mitigasi · advisory vendor
• https://github.com/pydantic/pydantic-ai/commit/453f19feeb7ab1d789f9393b1723c6a73b3d77b2 patch