multidict CVE-2026-104874

Exploitation requires ALL of the following: (1) the compiled C extension build of multidict (pure-Python builds are explicitly NOT affected); (2) an affected version from 6.7.0 up to but excluding 6.9.1; (3) the application must actually invoke one of two specific operations - the reflected items-view union 'operand | md.items()' or the items-view subtraction 'md.items() - operand'; (4) the operand must contain non-tuple elements (tuple operand elements, forward union 'md.items() | operand', and intersection are NOT affected); and (5) the operand contents must be attacker-influenced and repeatable at volume. Limiting factors that reduce real-world risk: these exact operation patterns are uncommon in typical application code, impact is confined to memory/availability (no code execution or data exposure), and the vulnerable path is one-directional (only the reflected union and subtraction leak).

This is a medium-severity, availability-only issue (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity impact - it is strictly a memory-leak denial-of-service (CWE-401). No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public exploit or POC is referenced (only a maintainer regression test accompanies the fix). SSVC-style reasoning: exploitation status is 'none observed,' technical impact is partial (A:L - degraded availability via unbounded memory growth, not full takeover), and automatability is limited because triggering requires the target application to actually perform the specific vulnerable operations. The network attack vector (AV:N) is realistic ONLY insofar as attacker-influenced data reaches one of two narrow code paths - reflected union 'operand | md.items()' or subtraction 'md.items() - operand' - against the C-extension build with non-tuple operand elements. The CVSS PR:N/AC:L signals a low barrier for the attacker once such a code path exists, but the real-world gate is whether any application exposes these exact operations to untrusted input, which sharply narrows exploitability. Net: this is a genuine but low-urgency DoS that warrants routine dependency patching rather than emergency response; it is a case where a plausible network vector overstates practical risk because the vulnerable operation pattern is uncommon in real applications.

A Python service using multidict's C extension (6.7.0-6.9.0) performs 'operand | md.items()' or 'md.items() - operand' where 'operand' is built from attacker-supplied, non-tuple-backed data (e.g., derived from request parameters). An attacker repeatedly submits large sequences; each element leaks two strong references (key-identity and value) that garbage collection cannot reclaim, driving the worker's memory upward until it is OOM-killed. No public exploit is identified at time of analysis, though the vendor's fix commit includes a regression test demonstrating the leak.