Kurz gesagt
- CVE-2025-68480 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in marshmallow.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.30%, höher als bei 22.4% aller Schwachstellen.
- Abhilfe: auf 3.26.2, 4.1.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| marshmallow PyPI | ≥ 3.0.0rc1, < 3.26.2≥ 4.0.0, < 4.1.2
| 3.26.24.1.2
|
Description
Impact
Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.
Patches
4.1.2, 3.26.2
Workarounds
# Fail fast
def load_many(schema, data, **kwargs):
if not isinstance(data, list):
raise ValidationError(['Invalid input type.'])
return [schema.load(item, **kwargs) for item in data]
NVD description
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free