CVE-2026-107286
Description
A flaw was found in pydantic-ai. When processing streamed requests under concurrency limits, shared concurrency slots may fail to release if a stream is interrupted, cancelled, or encounters an exception. A remote caller can exploit this issue by triggering incomplete streaming operations to permanently exhaust available capacity slots. This condition prevents subsequent requests from proceeding, resulting in a Denial of Service (DoS).
Statement
An IMPORTANT severity denial-of-service flaw was found in pydantic-ai, a Python agent framework for building generative AI applications, which is shipped in Red Hat Enterprise Linux AI and Lightspeed Core. When streamed requests are processed through model-level concurrency limiting (ConcurrencyLimitedModel or limit_model_concurrency), shared concurrency slots acquired from anyio.CapacityLimiter can fail to be released when a stream is terminated early, cancelled, or encounters an exception, because the capacity limiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. A remote attacker without authentication or user interaction can exploit this flaw by repeatedly initiating and abandoning streaming operations to permanently exhaust the shared concurrency capacity, preventing subsequent requests that share the long-lived limiter from being processed and causing a denial of service. Agent-level max_concurrency and non-streaming model requests are not affected. The Red Hat severity rating of IMPORTANT (CVSS 7.5) matches the upstream rating. Red Hat Enterprise Linux AI and Lightspeed Core ship the affected pydantic-ai package and are listed as affected, and fixes for these products are being pursued.
Mitigation
Applications using pydantic-ai can avoid this issue by not applying model-level concurrency limiting to streamed requests: configure concurrency limits through the agent-level max_concurrency setting or use non-streaming model requests, as those code paths are not affected. Where possible, upgrading to pydantic-ai 2.53.0 or later, which contains the upstream fix, is recommended. For Red Hat Enterprise Linux AI and Lightspeed Core, apply the updated containers and packages when they become available through the respective product releases.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
