Medium, CVSS 5.3PyPIAmendedPublished
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
CVE-2026-104874 · GHSA-54p9-h82j-f925
- Affected
- PyPI multidict >= 6.7.0, <= 6.9.0
- Fixed in
- 6.9.1· Vendor fix available
- Issue
- A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (operand | d.items(), multidictitemsviewor2impl) and the subtraction path (d.items() - operand, multidictitemsviewsub1impl) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed. --- Root Cause multidictitemsviewparseitem() returns new references: a fresh identity via mdcalcidentity() and a fresh value via PyNewRef(). The or2impl first parse loop…
Recommended action: Upgrade to 6.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.