Multidict
Monthly
Unbounded process memory growth in the multidict C extension (versions 6.7.0 up to but excluding 6.9.1) lets unauthenticated remote attackers drive a denial of service by repeatedly invoking two items-view set operations. The reflected union 'operand | md.items()' and the subtraction 'md.items() - operand' each fail to release one key-identity reference and one value reference per operand element, and because these are strong references the garbage collector cannot reclaim them, so memory grows without bound as operations repeat. The issue is availability-only (CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), patches only reachable in compiled C-extension builds with non-tuple, attacker-influenced operands, and there is no public exploit identified at time of analysis; the vendor-released fix is multidict 6.9.1.
Unbounded process memory growth in the multidict C extension (versions 6.7.0 up to but excluding 6.9.1) lets unauthenticated remote attackers drive a denial of service by repeatedly invoking two items-view set operations. The reflected union 'operand | md.items()' and the subtraction 'md.items() - operand' each fail to release one key-identity reference and one value reference per operand element, and because these are strong references the garbage collector cannot reclaim them, so memory grows without bound as operations repeat. The issue is availability-only (CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), patches only reachable in compiled C-extension builds with non-tuple, attacker-influenced operands, and there is no public exploit identified at time of analysis; the vendor-released fix is multidict 6.9.1.