CVE-2026-104874: 
Python Análisis y mitigación de vulnerabilidades

CVE-2026-104874 is a reference leak vulnerability in the multidict C extension library (aio-libs/multidict) that enables unauthenticated remote attackers to cause unbounded process memory growth, resulting in denial of service. The flaw affects versions 6.7.0 through 6.9.0 (inclusive) and was fixed in version 6.9.1. It was disclosed on September 21, 2026 via a GitHub Security Advisory and published to NVD on October 2, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an improper update of Python reference counts (CWE-911) and missing release of memory after effective lifetime (CWE-401) in the C extension's views.h file. Specifically, _multidict_itemsview_parse_item() returns new strong references for a key identity (via md_calc_identity()) and a value (via Py_NewRef()), but the first parse loops in multidict_itemsview_or2_impl (reflected union: operand | d.items()) and multidict_itemsview_sub1_impl (subtraction: d.items() - operand) only call Py_CLEAR(arg) — never Py_CLEAR(identity) or Py_CLEAR(value) — causing two strong references to leak per operand element. Because the leaked objects are not reachable by Python's cyclic garbage collector, gc.collect() cannot reclaim them, and resident memory grows monotonically. The regression was introduced in 6.7.0 by a key-identity ownership change in hashtable.h that made md_calc_identity() return a fresh strong reference; all sibling code paths (and1_impl, and2_impl, or1_impl) correctly clear all three references and are unaffected. Pure-Python builds (MULTIDICT_NO_EXTENSIONS=1) are also unaffected (GitHub Advisory, Fix Commit).

Successful exploitation causes unbounded, unrecoverable heap growth in the affected process, ultimately leading to process crash or unresponsiveness (denial of service). In the aio-libs stack, multidict backs HTTP headers and query strings, meaning an attacker can control the operand size by sending many repeated header items or query parameters to a server performing items-view union or subtraction operations. Proof-of-concept testing demonstrated RSS growth from 15.6 MB to over 1,266 MB (~250 MB per 2 million elements) despite per-iteration garbage collection. There is no confidentiality or integrity impact; results of the set operations remain correct and no data is exposed (GitHub Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is remotely exploitable without authentication or user interaction, but requires the target application to specifically perform operand | d.items() (reflected union) or d.items() - operand (subtraction) operations over attacker-influenced sequences. The EPSS score is approximately 0.297%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify web applications or API services built on the aio-libs stack (e.g., aiohttp) that use multidict versions 6.7.0–6.9.0 and perform items-view union (operand | d.items()) or subtraction (d.items() - operand) operations on attacker-supplied HTTP headers or query strings.
2. Craft malicious input: Construct HTTP requests containing a large number of unique header fields or query parameters (e.g., k0=v0&k1=v1&...&kN=vN) to maximize the operand size passed to the vulnerable set operations.
3. Send repeated requests: Repeatedly send these crafted requests to the target endpoint. Each request causes the server to leak two strong Python object references (one key identity, one value) per operand element, none of which can be reclaimed by the garbage collector.
4. Exhaust memory: Continue sending requests until the server process exhausts available memory, causing it to crash or become unresponsive, achieving denial of service (GitHub Advisory).

• Process Behavior: Steady, monotonically increasing RSS/memory usage of the Python server process that does not decrease after garbage collection cycles; memory growth of approximately 250 MB per 2 million operand elements processed.
• Logs: High volumes of requests to endpoints that process large numbers of HTTP headers or query parameters; requests with unusually large numbers of unique header fields or query string keys from a single source IP.
• Network: Repeated HTTP requests with abnormally large header sets or query strings targeting the same endpoint, potentially from a single client or distributed sources.
• System: Out-of-memory (OOM) killer events in system logs (/var/log/syslog, dmesg) terminating the Python/aiohttp server process; process restarts triggered by memory exhaustion (GitHub Advisory).

Upgrade multidict to version 6.9.1, which adds Py_CLEAR(identity) and Py_CLEAR(value) calls at the end of the first parse loops in both multidict_itemsview_or2_impl and multidict_itemsview_sub1_impl in views.h (Fix Commit, Release Notes). If immediate patching is not possible, install multidict with the environment variable MULTIDICT_NO_EXTENSIONS=1 to force the pure-Python build, which is not affected by this reference leak. Additionally, avoid performing operand | view.items() or view.items() - operand operations on attacker-influenced operands, and consider implementing rate limiting or input validation on the number of headers/query parameters accepted per request.

The vulnerability was reported by researcher waydeshi and fixed by asvetlov (a core aio-libs maintainer) via a GitHub Security Advisory (GHSA-54p9-h82j-f925) published September 21, 2026. The advisory includes detailed root cause analysis, proof-of-concept scripts, and version-boundary evidence, reflecting a thorough disclosure process. Red Hat tracked the issue via Bugzilla and published a CVE advisory. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat CVE).