Detections
Analytics

SCA: security update for pydantic-ai, pydantic-ai-slim (GHSA-6fqq-452j-qhrp)

high Tenable Cloud Security Plugin ID 473959

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From
 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can
 retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the
 borrowing task while streaming cleanup can run in a different task. Early stream termination,
 cancellation, consumer exceptions, or complete stream_text() consumption with debounce_by=0.1 can
 therefore leave capacity occupied, eventually preventing later requests that share the long-lived limiter
 from proceeding and causing a denial of service. Agent-level max_concurrency and non-streaming model
 requests are not affected. This issue is fixed in version 2.53.0. (CVE-2026-107286)

Solution

Update the pydantic-ai library and its related packages to version 2.53.0 or later.

See Also

https://github.com/advisories/GHSA-6fqq-452j-qhrp

Plugin Details

Severity: High

ID: 473959

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/9/2026

Updated: 10/9/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-107286

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-107286

cwe: CWE-772