medium5.3
CVE-2025-68480
Marshmallow has DoS in Schema.load(many)
Impact
### Impact `Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. ### Patches 4.1.2, 3.26.2 ### Workarounds ```py # Fail fast def load_many(schema, data, **kwargs): if not isinstance(data, list): raise ValidationError(['Invalid input type.']) return [schema.load(item, **kwargs) for item in data] ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | marshmallow | >= 3.0.0rc1, < 3.26.2 | 3.26.2 |
Affected products
| Product | Affected versions |
|---|---|
| Versions From 3.0.0rc1 To | before 3.26.2 |
| From 4.0.0 To | before 4.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
- https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5
- https://github.com/advisories/GHSA-428g-f7cq-pgp5
- https://nvd.nist.gov/vuln/detail/CVE-2025-68480