CVE-2026-104874 in multidict
Summary
by MITRE • 10/03/2026
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified within the Multidict library affects versions ranging from 6.7.0 through 6.9.1, specifically targeting the C extension implementation of multidimensional dictionary data structures. Multidict serves as a high-performance alternative to standard Python dictionaries, optimized for handling multiple values per key and supporting set-like operations on keys and items. The core issue resides in two specific internal functions: multidict_itemsview_or2_impl, which handles the union operation using the pipe operator such as d.items() | operand, and multidict_itemsview_sub1_impl, which manages the subtraction operation where an operand is removed from the items view via d.items() - operand. These operations are critical for applications that rely on set-theoretic manipulations of dictionary contents to filter or merge data sets efficiently.
The technical flaw stems from a reference counting error in the C extension code responsible for processing these binary operations. When iterating over elements within an operand sequence during union or subtraction, the implementation fails to properly release new key-identity and value references generated for each element processed. In Python's memory management model, objects are kept alive as long as there is at least one reference pointing to them. By neglecting to decrement these reference counts after use, the code inadvertently creates a strong reference leak. This means that every time an operation is performed on an attacker-influenced sequence, two additional references per element remain in memory indefinitely. The garbage collector cannot reclaim this memory because the objects are still considered reachable by the interpreter's internal state.
The operational impact of this vulnerability is significant for any application performing these specific operations over untrusted or dynamically generated data sequences. Since each operation leaks memory proportional to the size of the operand, repeated executions can lead to unbounded process memory growth. This behavior effectively constitutes a denial of service condition, as the consuming application will eventually exhaust available system memory, leading to crashes or severe performance degradation due to excessive garbage collection cycles and swapping. The severity is heightened in long-running services such as web servers or background workers that might routinely merge or filter large datasets based on external inputs without realizing they are accumulating leaked references over time.
It is important to note the scope of this vulnerability, which excludes certain scenarios from being affected. Forward union operations, intersection calculations, cases involving non-tuple operand elements, and builds relying purely on Python code rather than the C extension are not susceptible to this specific reference leak. This distinction highlights that the flaw is isolated to the optimized C implementation handling specific binary operators with particular data types. Consequently, applications using pure-Python fallbacks or different operational patterns remain secure against this particular memory exhaustion vector, although they may still face performance trade-offs compared to the vulnerable C extension.
To mitigate this risk, organizations must ensure that all instances of the Multidict library are upgraded to version 6.9.1 or later, where the reference counting logic has been corrected to properly release temporary references after each element is processed. For systems unable to upgrade immediately due to dependency constraints, implementing strict input validation and limiting the size of sequences passed into union or subtraction operations can help mitigate the rate of memory leakage. Additionally, monitoring process memory usage for anomalies correlated with multidict operations may serve as an early detection mechanism for exploitation attempts in production environments.
From a classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective usage, leading to resource exhaustion. In the context of attack patterns, it relates to ATT&CK technique T1496, Resource Hijacking, specifically through environmental hijacking where an attacker consumes system resources like memory to degrade service availability. Understanding these classifications helps in mapping the vulnerability to broader security frameworks and ensuring that remediation efforts address both the immediate code defect and the potential for abuse as a denial-of-service vector.