{"items":[{"id":"NVI-00011905","kind":"vulnerability","title":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-54p9-h82j-f925","CVE-2026-104874"],"plain_summary":"GitHub lists this reviewed advisory for multidict. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9cd42faf945a909eb1c815d98177eeec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-05T23:40:59.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5921690e4ddd7d0ca6cf95557ba87e3c"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.448%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.38972. Missing scores are unknown.","source_id":"sr-9cd42faf945a909eb1c815d98177eeec"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5921690e4ddd7d0ca6cf95557ba87e3c","url":"https://github.com/advisories/GHSA-54p9-h82j-f925","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-54p9-h82j-f925","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:16.959Z"},{"id":"sr-9cd42faf945a909eb1c815d98177eeec","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-104874","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.063Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5921690e4ddd7d0ca6cf95557ba87e3c"],"technology":"multidict","known_exclusions":[],"conditions_summary":"## Description\n\nA reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (`operand | d.items()`, `multidict_itemsview_or2_impl`) and the subtraction path (`d.items() - operand`, `multidict_itemsview_sub1_impl`) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.\n\n---\n\n## Root Cause\n\n`_multidict_itemsview_parse_item()` returns **new** references: a fresh identity via `md_calc_identity()` and a fresh value via `Py_NewRef()`. The `or2_impl` first parse loop requests both but clears only `arg`:\n\n```c\n// views.h:565 — or2_impl first parse loop\nwhile ((st = PyIter_NextItem(iter, &arg)) > 0) {\n    int tmp = _multidict_ite","public_affected_ranges":[">= 6.7.0, <= 6.9.0"]}],"null_published_at":"2026-11-07T00:57:04.315Z","source_updated_at":"2026-10-05T23:40:59.000Z","source_disclosed_at":"2026-10-05T23:40:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:59:16.959Z"},{"id":"NVI-00011905","kind":"vulnerability","title":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-54p9-h82j-f925","CVE-2026-104874"],"plain_summary":"GitHub lists this reviewed advisory for multidict. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5921690e4ddd7d0ca6cf95557ba87e3c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-05T23:40:59.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5921690e4ddd7d0ca6cf95557ba87e3c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5921690e4ddd7d0ca6cf95557ba87e3c","url":"https://github.com/advisories/GHSA-54p9-h82j-f925","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-54p9-h82j-f925","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:16.959Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5921690e4ddd7d0ca6cf95557ba87e3c"],"technology":"multidict","known_exclusions":[],"conditions_summary":"## Description\n\nA reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (`operand | d.items()`, `multidict_itemsview_or2_impl`) and the subtraction path (`d.items() - operand`, `multidict_itemsview_sub1_impl`) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.\n\n---\n\n## Root Cause\n\n`_multidict_itemsview_parse_item()` returns **new** references: a fresh identity via `md_calc_identity()` and a fresh value via `Py_NewRef()`. The `or2_impl` first parse loop requests both but clears only `arg`:\n\n```c\n// views.h:565 — or2_impl first parse loop\nwhile ((st = PyIter_NextItem(iter, &arg)) > 0) {\n    int tmp = _multidict_ite","public_affected_ranges":[">= 6.7.0, <= 6.9.0"]}],"null_published_at":"2026-11-01T01:03:56.614Z","source_updated_at":"2026-10-05T23:40:59.000Z","source_disclosed_at":"2026-10-05T23:40:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:59:16.959Z"}],"next_cursor":null,"snapshot_revision":"42594"}