In short
- CVE-2025-68480 is a MEDIUM (CVSS 5.3) vulnerability affecting marshmallow.
- Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.4% of all vulnerabilities.
- Fix: update to 3.26.2, 4.1.2 or later.
| Package | Affected versions | Patched versions |
|---|
| marshmallow PyPI | ≥ 3.0.0rc1, < 3.26.2≥ 4.0.0, < 4.1.2
| 3.26.24.1.2
|
Description
Impact
Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.
Patches
4.1.2, 3.26.2
Workarounds
# Fail fast
def load_many(schema, data, **kwargs):
if not isinstance(data, list):
raise ValidationError(['Invalid input type.'])
return [schema.load(item, **kwargs) for item in data]
NVD description
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free