CVE-2026-104874

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104874

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104874.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104874

Aliases

GHSA-54p9-h82j-f925

Published

2026-10-02T20:21:50Z

Modified

2026-10-04T07:03:19Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Details

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104874.json"
}

References

Affected packages

Git / github.com/aio-libs/multidict

Affected ranges

Type

GIT

Repo

https://github.com/aio-libs/multidict

Events

Introduced

e2a8d083ae1f73c54de70ae5c2a6611455606798

Fixed

350b4a07bf8ff851b6d7544e81b1c748bdc74c40

Fixed

0a1770c7e69845c8ef2000b3707cd7f1917a6944

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "6.7.0"
        },
        {
            "fixed":  "6.9.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v6.*

v6.7.0

v6.7.1

v6.8.0

v6.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104874.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "245219725003706419560517680975761149569",
            "length":  1463
        },
        "id":  "CVE-2026-104874-45498515",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40",
        "target":  {
            "file":  "multidict/_multilib/views.h",
            "function":  "multidict_itemsview_sub1_impl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "229276718217287221084695703359855025945",
            "length":  1464
        },
        "id":  "CVE-2026-104874-50e7d086",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40",
        "target":  {
            "file":  "multidict/_multilib/views.h",
            "function":  "multidict_itemsview_or2_impl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "162399698049687437278031202911337587692",
                "19845450706849028236357436103957295849",
                "223584829462021231325288603758508971737",
                "197883922027818880744640604669530208712",
                "162399698049687437278031202911337587692",
                "19845450706849028236357436103957295849",
                "223584829462021231325288603758508971737",
                "197883922027818880744640604669530208712",
                "44030674566069976522907049114239182402",
                "197747011653481430650123322444900552272",
                "82076025070124223231274094486462804913",
                "223057317761106486403622068555234199852",
                "99546790402133199371339235881996165986",
                "3579547652917889615046197621670460282",
                "18689897617884663664027793728327457682",
                "25016217542687610157851565226880024885",
                "250987360933512483427626230430711680253",
                "271777507411845652130768767910071891063",
                "324549055254611937209976101827214292269"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-104874-776185a6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40",
        "target":  {
            "file":  "multidict/_multilib/views.h"
        }
    }
]

vanir_signatures_modified

"2026-10-04T07:03:19Z"