Vulnerability GHSA-54p9-h82j-f925
Summary
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Details
Description
A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The reflected-union path (operand | d.items(), multidict_itemsview_or2_impl) and the subtraction path (d.items() - operand, multidict_itemsview_sub1_impl) parse each element into new strong references but release only the tuple wrapper, never the identity and value. Servers in the aio-libs stack build these views over attacker-supplied HTTP headers and query strings, so the operand size is under remote control. Forced garbage collection does not recover the leaked objects, so resident memory rises monotonically until the process is killed.
Reproduction Environment
| Item | Value |
|---|---|
| Runtime | CPython 3.14.6 |
| multidict | 6.9.0 (PyPI binary wheel, C extension) |
| OS | macOS (darwin 25.6.0, arm64) |
Impact
A process that evaluates items-view unions or subtractions over remote-influenced operands leaks one identity plus one value object per element, permanently. In the aio-libs stack multidict backs HTTP headers and query strings, so an attacker who enlarges the operand (for example, many repeated header items compared against a fixed allow/deny set) forces steady, unrecoverable heap growth and can eventually exhaust memory in a long-lived server. This is an availability defect only; results stay correct and no data is exposed.
Reachability depends on the application evaluating operand | view.items() (reflected union) or view.items() - operand (subtraction) over a sequence of 2-tuples whose count is remote-influenced. The forward union view.items() | operand routes to or1_impl, which clears correctly and does not leak; a non-tuple operand element takes the parse_item early-return and does not leak. Set algebra over items views is not the most common multidict usage, which bounds exposure and is why this is Medium, not High. This is distinct from PR #1413, which fixed a temporary-tuple leak in the second loop and did not release these per-element objects.
