Detections
Analytics

SCA: security update for multidict (GHSA-54p9-h82j-f925)

medium Tenable Self-Hosted Container Security Plugin ID 472973

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's
 items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction
 operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and
 value references returned for each operand element. Applications that perform these operations over
 attacker-influenced sequences can leak two strong references per element, and garbage collection cannot
 reclaim them, so repeated operations can cause unbounded process memory growth and denial of service.
 Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this
 reference leak. This issue is fixed in version 6.9.1. (CVE-2026-104874)

Solution

Update the multidict library and its related packages to version 6.9.1 or later.

See Also

https://github.com/advisories/GHSA-54p9-h82j-f925

Plugin Details

Severity: Medium

ID: 472973

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-104874

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-104874

cwe: CWE-401