[pkg-vuln] CVE-2026-104874 in multidict@6.7.1 #1236

New Issue

kert · 2026-10-25T18:53:37Z

kert commented

2026-10-25 18:53:37 +00:00

Severity: MEDIUM
Package: multidict @ 6.7.1
Fixed in: 6.9.1

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage c

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-104874

**Severity:** MEDIUM **Package:** `multidict` @ `6.7.1` **Fixed in:** `6.9.1` Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage c **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-104874

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-25 18:53:37 +00:00

kert added the quality ci labels 2026-10-25 18:53:37 +00:00

kert referenced this issue

2026-10-25 20:36:16 +00:00

bcda: attribution expiration, January blackout and oldest-attribution-file floor in the _since checks #1295

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1236