CVE-2026-104874

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Published Oct 2, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Analysis

Technical impact

A reference leak in the C extension of the multidict library caused the items‑view union and subtraction operations to leak two strong references per element when the operand objects were supplied by an attacker. Over many repeated operations the leak accumulates an unbounded number of references that cannot be reclaimed by the garbage collector, leading to uncontrolled process memory growth and eventual denial of service. The flaw is characterized by CWE‑401 and CWE‑911 and is scored with a CVSS score of 5.3.

Affected Systems

The vulnerability affects the aio‑libs multidict package, specifically releases from version 6.7.0 through 6.9.1 inclusive. No fixed versions are listed beyond 6.9.1, and there are no sub‑module or patch‑release details provided in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 places this issue in the moderate severity range; the EPSS score is not available, but the vulnerability can be exploited by repeatedly calling the union or subtraction operations with attacker‑controlled data. Because the leak is internal to the library and requires the application to perform these operations, it is inferred that the attack vector is application‑level, not remote network‑based. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been documented yet. Nonetheless, the impact of memory exhaustion can cripple service availability, so the risk remains significant for systems that expose this functionality to untrusted input.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aio-libs

multidict

affected

Version	Status	Constraints
`>= 6.7.0, < 6.9.1`	affected	—

No data.

Vendor Product Versions

Aio-libs

Multidict

Version	Status	Scheme	Platform
`[6.7.0,6.9.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the multidict package to version 6.9.1 or later.
Refactor or remove any code paths that perform union or subtraction on data supplied by untrusted sources.
Monitor the application’s memory usage and enforce thresholds or automated restarts to contain out‑of‑memory growth.

Generated by OpenCVE AI on October 3, 2026 at 01:20 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-54p9-h82j-f925	Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.448% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40
https://github.com/aio-libs/multidict/releases/tag/v6.9.1
https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925
https://nvd.nist.gov/vuln/detail/CVE-2026-104874
https://www.cve.org/CVERecord?id=CVE-2026-104874

History

Oct 5, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 4, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aio-libs Aio-libs multidict
Vendors & Products		Aio-libs Aio-libs multidict

Oct 3, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://nvd.nist.gov/vuln/detail/CVE-2026-104874 https://www.cve.org/CVERecord?id=CVE-2026-104874
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 2, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand \| d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.
Title		Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Weaknesses		CWE-401
References		https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40 https://github.com/aio-libs/multidict/releases/tag/v6.9.1 https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`