[Git][security-tracker-team/security-tracker][master] Add CVE-2026-104874/python-multidict

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cbe449da by Salvatore Bonaccorso at 2026-10-03T12:14:47+02:00
Add CVE-2026-104874/python-multidict

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -176,7 +176,9 @@ CVE-2026-104887
 CVE-2026-104886
 	REJECTED
 CVE-2026-104874 (Multidict is an implementation of a multidict data structure. From 6.7 ...)
-	TODO: check
+	- python-multidict <not-affected> (Vulnerable code introduced later)
+	NOTE: https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925
+	NOTE: Fixed by: https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40 (v6.9.1)
 CVE-2026-104873 (LangGraph Python SDK is used to connect to running LangGraph API serve ...)
 	NOT-FOR-US: LangGraph Python SDK
 CVE-2026-104872 (OpenTelemetry JavaScript Contrib provides instrumentation libraries fo ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbe449dabd32b267039460b93cfccfa1fc40e469

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbe449dabd32b267039460b93cfccfa1fc40e469
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/e9f10eff/attachment.htm>