# CVE-2026-104874: multidict reference leak in items-view union and subtraction

Source: https://junglewise.ai/threats/cve-2026-104874-multidict-is-an-implementation-of-a-multidict-data-structure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104874 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Multidict is a Python library that manages dictionaries with multiple values per key. The C extension's items-view operations fail to release memory references, allowing attackers to cause unbounded memory growth through repeated operations on attacker-controlled data. This leads to denial of service by exhausting available memory.

Vendors: [Aio-Libs](https://junglewise.ai/threats/vendors/aio-libs), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-104874 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104874 being exploited in the wild.

**How severe is CVE-2026-104874?** Medium severity, with a CVSS score of 5.3, published 2 October 2026.

**Which products and versions are affected?** Aio-Libs Multidict 6.7.0 to 6.9.0; multidict (PyPI) >= 6.7.0, <= 6.9.0, ECOSYSTEM:introduced=6.7.0,fixed=6.9.1.

**Is there a fix for CVE-2026-104874?** Yes. multidict (PyPI): upgrade to 6.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104874 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104874?** Check whether you run Aio-Libs Multidict or multidict (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- multidict (PyPI): upgrade to 6.9.1 or later

  ```sh
  pip install "multidict>=6.9.1"
  ```


## Technical details

The C extension implementations multidict_itemsview_or2_impl() (operand | d.items()) and multidict_itemsview_sub1_impl() (d.items() - operand) leak key-identity and value references for each operand element because they only release the item tuple, not the individual key and value references. Garbage collection cannot reclaim these leaked references, causing unbounded process memory growth. Forward union, intersection, non-tuple operand elements, and pure-Python builds are unaffected.

## Affected products

- aio-libs multidict 6.7.0 to 6.9.0

## Identifiers

- CVE-2026-104874
- GHSA-54p9-h82j-f925
- PYSEC-2026-4244

## Timeline

- 2026-10-02: disclosed
- 2026-09-21: patched

## References

- [https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40](https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40)
- [https://github.com/aio-libs/multidict/releases/tag/v6.9.1](https://github.com/aio-libs/multidict/releases/tag/v6.9.1)