CVE-2026-104874 · GHSA-54p9-h82j-f925
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
- Risk score
- 46/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value …
- Affected
- multidict (pip) >= 6.7.0, <= 6.9.0
- Fix
- Upgrade multidict to 6.9.1 or later.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 5.3 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| multidict | pip | >= 6.7.0, <= 6.9.0 | 6.9.1 |
References
- https://github.com/advisories/GHSA-54p9-h82j-f925
- https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925
- https://nvd.nist.gov/vuln/detail/CVE-2026-104874
- https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40
- https://github.com/aio-libs/multidict/releases/tag/v6.9.1
- https://github.com/advisories/GHSA-54p9-h82j-f925
Original description
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.
Last activity 2 Oct 2026. Patch Forecast updates every hour.