Am I affected by Pydantic AI: concurrency-limited models can keep their slot when a streamed request ends…? What should I do?

1 answer

• Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

  Am I affected? Affected: pydantic-ai and pydantic-ai-slim 2.10.0 to before 2.53.0. Fixed in: 2.53.0.

  • Check your version: run pip show pydantic-ai. Versions >= 2.10.0, < 2.53.0 of pydantic-ai are affected.
  • Check your version: run pip show pydantic-ai-slim. Versions >= 2.10.0, < 2.53.0 of pydantic-ai-slim are affected.

  What to do now

  1. Upgrade to the fixed version: run pip install --upgrade "pydantic-ai>=2.53.0" (first patched version 2.53.0).
  2. Upgrade to the fixed version: run pip install --upgrade "pydantic-ai-slim>=2.53.0" (first patched version 2.53.0).
  3. Upgrade pydantic-ai to 2.53.0.
  4. Upgrade pydantic-ai-slim to 2.53.0.
  5. If you cannot upgrade yet, use the agent-level max_concurrency setting instead of a concurrency-limited model.
  6. If you cannot upgrade yet, avoid streaming runs through a concurrency-limited model.

  General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

  Sources

  • GitHub Advisory Database: https://github.com/advisories/GHSA-6fqq-452j-qhrp (opens external site) ↗

  Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-107286-pydantic-ai-pydantic-ai-pydantic-ai-slim (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport