Missing Release of Resource after Effective Lifetime Affecting pydantic-ai-slim package, versions [2.10.0,2.53.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYDANTICAISLIM-20849110
- published13 Oct 2026
- disclosed8 Oct 2026
- creditlche511
Introduced: 8 Oct 2026
NewCVE-2026-107286 (opens in a new tab)How to fix?
Upgrade pydantic-ai-slim to version 2.53.0 or higher.
Overview
pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a concurrency slot is leaked when a streamed response is iterated and closed on a different task than the one that acquired the slot, because the underlying anyio.CapacityLimiter ties each slot to the acquiring task. This causes the limiter to become permanently exhausted, blocking all subsequent agent runs that share the same ConcurrencyLimiter and effectively crashing the application's concurrency management.