Is CVE-2026-104874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104874 being exploited in the wild.

How severe is CVE-2026-104874?

Medium severity, with a CVSS score of 5.3, published 2 October 2026.

Which products and versions are affected?

Aio-Libs Multidict 6.7.0 to 6.9.0; multidict (PyPI) >= 6.7.0, <= 6.9.0, ECOSYSTEM:introduced=6.7.0,fixed=6.9.1.

Is there a fix for CVE-2026-104874?

Yes. multidict (PyPI): upgrade to 6.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104874 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104874?

Check whether you run Aio-Libs Multidict or multidict (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104874: multidict reference leak in items-view union and subtraction

Q: Is there a fix for CVE-2026-104874?

Yes. multidict (PyPI): upgrade to 6.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-104874 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-104874?

Check whether you run Aio-Libs Multidict or multidict (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104874 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Multidict is a Python library that manages dictionaries with multiple values per key. The C extension's items-view operations fail to release memory references, allowing attackers to cause unbounded memory growth through repeated operations on attacker-controlled data. This leads to denial of service by exhausting available memory.

Vendors: Aio-Libs, PyPI.

Quick answers

Is CVE-2026-104874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104874 being exploited in the wild.
How severe is CVE-2026-104874?: Medium severity, with a CVSS score of 5.3, published 2 October 2026.
Which products and versions are affected?: Aio-Libs Multidict 6.7.0 to 6.9.0; multidict (PyPI) >= 6.7.0, <= 6.9.0, ECOSYSTEM:introduced=6.7.0,fixed=6.9.1.
Is there a fix for CVE-2026-104874?: Yes. multidict (PyPI): upgrade to 6.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104874 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104874?: Check whether you run Aio-Libs Multidict or multidict (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multidict (PyPI): upgrade to 6.9.1 or later
```
pip install "multidict>=6.9.1"
```

Technical details

The C extension implementations multidict_itemsview_or2_impl() (operand | d.items()) and multidict_itemsview_sub1_impl() (d.items() - operand) leak key-identity and value references for each operand element because they only release the item tuple, not the individual key and value references. Garbage collection cannot reclaim these leaked references, causing unbounded process memory growth. Forward union, intersection, non-tuple operand elements, and pure-Python builds are unaffected.

Affected products

aio-libs multidict 6.7.0 to 6.9.0

Identifiers

CVE-2026-104874
GHSA-54p9-h82j-f925
PYSEC-2026-4244

Timeline

2026-10-02: disclosed
2026-09-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.