Vulnerability	Vulnerable Version
M Missing Release of Memory after Effective Lifetime Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a reference leak in the C extension's items view operations `multidict_itemsview_or2_impl()` and `multidict_itemsview_sub1_impl()`, which handle the `operand \| md.items()` and `md.items() - operand` set operations respectively. For every element of the operand, the key identity and value references are not released after processing, causing memory to grow without bound when a large operand is used. An attacker can trigger unbounded memory growth by repeatedly invoking these operations with large operands, resulting in a denial of service. How to fix Missing Release of Memory after Effective Lifetime? Upgrade `multidict` to version 6.9.1 or higher.	[6.7.0,6.9.1)

Missing Release of Memory after Effective Lifetime

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a reference leak in the C extension's items view operations multidict_itemsview_or2_impl() and multidict_itemsview_sub1_impl(), which handle the operand | md.items() and md.items() - operand set operations respectively. For every element of the operand, the key identity and value references are not released after processing, causing memory to grow without bound when a large operand is used. An attacker can trigger unbounded memory growth by repeatedly invoking these operations with large operands, resulting in a denial of service.

How to fix Missing Release of Memory after Effective Lifetime?

Upgrade multidict to version 6.9.1 or higher.

[6.7.0,6.9.1)

Go back to all versions of this package