AIKIDO-2026-338732

TL;DR

The multidict C extension items-view union and subtraction operators parse each operand pair into new strong references for the key identity and value, then release only the tuple wrapper. Evaluating operand | d.items() or d.items() - operand therefore leaks one identity object and one value object per element, and garbage collection cannot reclaim them. A remote client that enlarges that operand, for example by sending many HTTP header items compared against a fixed allow or deny set, can force unreclaimable heap growth until the process is killed. The fix clears the identity and value references at the end of each parse-loop iteration, matching the other set-algebra paths.