CVE-2026-104874

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Description

A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (operand | d.items(), multidict_itemsview_or2_impl) and the subtraction path (d.items() - operand, multidict_itemsview_sub1_impl) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.

Root Cause

_multidict_itemsview_parse_item() returns new references: a fresh identity via md_calc_identity() and a fresh value via Py_NewRef(). The or2_impl first parse loop requests both but clears only arg:

// views.h:565 — or2_impl first parse loop
while ((st = PyIter_NextItem(iter, &arg)) > 0) {
    int tmp = _multidict_itemsview_parse_item(
        self, arg, &identity, NULL, &value);   // identity + value: new refs
    if (tmp < 0) goto fail;
    else if (tmp > 0) {
        if (_set_add(tmp_set, identity, value) < 0) goto fail;
    }
    Py_CLEAR(arg);                             // :575 clears arg ONLY
}

_set_add() builds its own tuple with PyTuple_Pack and Py_DECREFs it, so it never borrows the loop's identity/value. On the next iteration those variables are overwritten, so the previous references are lost permanently. The sub1_impl first loop (:686-696) has the identical omission.

This is an editing slip, not an ownership contract: every sibling path clears all three references per iteration, and1_impl (:304-306), and2_impl (:389-391), or1_impl (:506-508), and the second (md_next) loops of both functions (:605-607, :726-728). PR #1413 added a Py_DECREF(tpl) to the second loop of or2/sub1, fixing a different temporary-tuple leak; it never touched the first parse loop, so this leak remains on master.

views.h is byte-identical between v6.6.0 and v6.7.0, yet 6.6.4 does not leak and 6.7.0 does. The regression is behavioural, introduced by a key-identity ownership change in hashtable.h across that boundary that made md_calc_identity() return a fresh strong reference the unchanged parse loop never releases.

Reproduction Environment

| Item | Value | |------|-------| | Runtime | CPython 3.14.6 | | multidict | 6.9.0 (PyPI binary wheel, C extension) | | OS | macOS (darwin 25.6.0, arm64) |

Proof of Concept

POC Source Code

poc_refcount.py — leak proof with intersection control

import sys, gc
from multidict import CIMultiDict

def probe(name, run_op):
    d = CIMultiDict(); d["seed"] = "x"
    value = object()                 # unique sentinel
    N = 100000
    operand = [("k%d" % i, value) for i in range(N)]
    gc.collect(); before = sys.getrefcount(value)
    run_op(d, operand)
    gc.collect(); after = sys.getrefcount(value)
    print(f"[{name}] leaked strong refs = {after - before}")

probe("or2  operand | items", lambda d, o: o | d.items())    # reflected union
probe("sub1 items - operand", lambda d, o: d.items() - o)    # subtraction
probe("and2 items & operand", lambda d, o: d.items() & o)    # CONTROL: clears, expect 0

poc_dispatch.py — maps which paths leak

import sys, gc
from multidict import CIMultiDict

def probe(name, fn):
    d = CIMultiDict(); d["seed"] = "x"
    v = object(); N = 50000
    operand = [("k%d" % i, v) for i in range(N)]
    gc.collect(); before = sys.getrefcount(v)
    fn(d, operand); gc.collect(); after = sys.getrefcount(v)
    print(f"{name:35s} leaked={after - before}")

probe("operand | d.items()  (or2)",…

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

Description

A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (operand | d.items(), multidict_itemsview_or2_impl) and the subtraction path (d.items() - operand, multidict_itemsview_sub1_impl) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.

Root Cause

_multidict_itemsview_parse_item() returns new references: a fresh identity via md_calc_identity() and a fresh value via Py_NewRef(). The or2_impl first parse loop requests both but clears only arg:

// views.h:565 — or2_impl first parse loop
while ((st = PyIter_NextItem(iter, &arg)) > 0) {
    int tmp = _multidict_itemsview_parse_item(
        self, arg, &identity, NULL, &value);   // identity + value: new refs
    if (tmp < 0) goto fail;
    else if (tmp > 0) {
        if (_set_add(tmp_set, identity, value) < 0) goto fail;
    }
    Py_CLEAR(arg);                             // :575 clears arg ONLY
}

_set_add() builds its own tuple with PyTuple_Pack and Py_DECREFs it, so it never borrows the loop's identity/value. On the next iteration those variables are overwritten, so the previous references are lost permanently. The sub1_impl first loop (:686-696) has the identical omission.

This is an editing slip, not an ownership contract: every sibling path clears all three references per iteration, and1_impl (:304-306), and2_impl (:389-391), or1_impl (:506-508), and the second (md_next) loops of both functions (:605-607, :726-728). PR #1413 added a Py_DECREF(tpl) to the second loop of or2/sub1, fixing a different temporary-tuple leak; it never touched the first parse loop, so this leak remains on master.

views.h is byte-identical between v6.6.0 and v6.7.0, yet 6.6.4 does not leak and 6.7.0 does. The regression is behavioural, introduced by a key-identity ownership change in hashtable.h across that boundary that made md_calc_identity() return a fresh strong reference the unchanged parse loop never releases.

Reproduction Environment

| Item | Value | |------|-------| | Runtime | CPython 3.14.6 | | multidict | 6.9.0 (PyPI binary wheel, C extension) | | OS | macOS (darwin 25.6.0, arm64) |

Proof of Concept

POC Source Code

poc_refcount.py — leak proof with intersection control

import sys, gc
from multidict import CIMultiDict

def probe(name, run_op):
    d = CIMultiDict(); d["seed"] = "x"
    value = object()                 # unique sentinel
    N = 100000
    operand = [("k%d" % i, value) for i in range(N)]
    gc.collect(); before = sys.getrefcount(value)
    run_op(d, operand)
    gc.collect(); after = sys.getrefcount(value)
    print(f"[{name}] leaked strong refs = {after - before}")

probe("or2  operand | items", lambda d, o: o | d.items())    # reflected union
probe("sub1 items - operand", lambda d, o: d.items() - o)    # subtraction
probe("and2 items & operand", lambda d, o: d.items() & o)    # CONTROL: clears, expect 0

poc_dispatch.py — maps which paths leak

import sys, gc
from multidict import CIMultiDict

def probe(name, fn):
    d = CIMultiDict(); d["seed"] = "x"
    v = object(); N = 50000
    operand = [("k%d" % i, v) for i in range(N)]
    gc.collect(); before = sys.getrefcount(v)
    fn(d, operand); gc.collect(); after = sys.getrefcount(v)
    print(f"{name:35s} leaked={after - before}")

probe("operand | d.items()  (or2)",…

Description

A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (operand | d.items(), multidict_itemsview_or2_impl) and the subtraction path (d.items() - operand, multidict_itemsview_sub1_impl) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.

Root Cause

_multidict_itemsview_parse_item() returns new references: a fresh identity via md_calc_identity() and a fresh value via Py_NewRef(). The or2_impl first parse loop requests both but clears only arg:

// views.h:565 — or2_impl first parse loop
while ((st = PyIter_NextItem(iter, &arg)) > 0) {
    int tmp = _multidict_itemsview_parse_item(
        self, arg, &identity, NULL, &value);   // identity + value: new refs
    if (tmp < 0) goto fail;
    else if (tmp > 0) {
        if (_set_add(tmp_set, identity, value) < 0) goto fail;
    }
    Py_CLEAR(arg);                             // :575 clears arg ONLY
}

_set_add() builds its own tuple with PyTuple_Pack and Py_DECREFs it, so it never borrows the loop's identity/value. On the next iteration those variables are overwritten, so the previous references are lost permanently. The sub1_impl first loop (:686-696) has the identical omission.

This is an editing slip, not an ownership contract: every sibling path clears all three references per iteration, and1_impl (:304-306), and2_impl (:389-391), or1_impl (:506-508), and the second (md_next) loops of both functions (:605-607, :726-728). PR #1413 added a Py_DECREF(tpl) to the second loop of or2/sub1, fixing a different temporary-tuple leak; it never touched the first parse loop, so this leak remains on master.

views.h is byte-identical between v6.6.0 and v6.7.0, yet 6.6.4 does not leak and 6.7.0 does. The regression is behavioural, introduced by a key-identity ownership change in hashtable.h across that boundary that made md_calc_identity() return a fresh strong reference the unchanged parse loop never releases.

Reproduction Environment

| Item | Value | |------|-------| | Runtime | CPython 3.14.6 | | multidict | 6.9.0 (PyPI binary wheel, C extension) | | OS | macOS (darwin 25.6.0, arm64) |

Proof of Concept

POC Source Code

poc_refcount.py — leak proof with intersection control

import sys, gc
from multidict import CIMultiDict

def probe(name, run_op):
    d = CIMultiDict(); d["seed"] = "x"
    value = object()                 # unique sentinel
    N = 100000
    operand = [("k%d" % i, value) for i in range(N)]
    gc.collect(); before = sys.getrefcount(value)
    run_op(d, operand)
    gc.collect(); after = sys.getrefcount(value)
    print(f"[{name}] leaked strong refs = {after - before}")

probe("or2  operand | items", lambda d, o: o | d.items())    # reflected union
probe("sub1 items - operand", lambda d, o: d.items() - o)    # subtraction
probe("and2 items & operand", lambda d, o: d.items() & o)    # CONTROL: clears, expect 0

poc_dispatch.py — maps which paths leak

import sys, gc
from multidict import CIMultiDict

def probe(name, fn):
    d = CIMultiDict(); d["seed"] = "x"
    v = object(); N = 50000
    operand = [("k%d" % i, v) for i in range(N)]
    gc.collect(); before = sys.getrefcount(v)
    fn(d, operand); gc.collect(); after = sys.getrefcount(v)
    print(f"{name:35s} leaked={after - before}")

probe("operand | d.items()  (or2)",…

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.

These are all security issues fixed in the python313-multidict-7.0.0-1.1 package on the GA media of openSUSE Tumbleweed.