A reference leak in the C extension of the multidict library caused the items‑view union and subtraction operations to leak two strong references per element when the operand objects were supplied by an attacker. Over many repeated operations the leak accumulates an unbounded number of references that cannot be reclaimed by the garbage collector, leading to uncontrolled process memory growth and eventual denial of service. The flaw is characterized by CWE‑401 and CWE‑911 and is scored with a CVSS score of 5.3.

The vulnerability affects the aio‑libs multidict package, specifically releases from version 6.7.0 through 6.9.1 inclusive. No fixed versions are listed beyond 6.9.1, and there are no sub‑module or patch‑release details provided in the CNA data.

The CVSS score of 5.3 places this issue in the moderate severity range; the EPSS score is not available, but the vulnerability can be exploited by repeatedly calling the union or subtraction operations with attacker‑controlled data. Because the leak is internal to the library and requires the application to perform these operations, it is inferred that the attack vector is application‑level, not remote network‑based. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been documented yet. Nonetheless, the impact of memory exhaustion can cripple service availability, so the risk remains significant for systems that expose this functionality to untrusted input.