CVE-2026-104874 is a reference leak vulnerability in the items-view union and subtraction operators of the aio-libs/multidict Python library versions 6.7.0 through 6.9.0. The flaw causes unbounded memory growth by leaking key-identity and value objects during certain set operations on dictionary views. This leak occurs because new references are created but never released in specific code paths. The vulnerability can be triggered remotely by supplying large HTTP headers or query strings to servers using this library, causing memory exhaustion until the process is terminated.