{"id":"CVE-2025-68480","aliases":["DEBIAN-CVE-2025-68480","EUVD-2025-204752","GHSA-428g-f7cq-pgp5","OESA-2026-3036","OESA-2026-3037","PYSEC-2026-1605","ROOT-APP-PYPI-CVE-2025-68480","SUSE-SU-2026:0226-1","SUSE-SU-2026:20130-1","UBUNTU-CVE-2025-68480","USN-8225-1","openSUSE-SU-2026:10003-1","openSUSE-SU-2026:20087-1"],"status":"published","title":"Marshmallow has DoS in Schema.load(many)","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00296,"percentile":0.22452,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-405"],"published":"2025-12-22T20:20:07Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"PyPI","package":"marshmallow","fixed_in":["3.26.2","4.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-marshmallow","fixed_in":["3.26.2-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-marshmallow","fixed_in":["3.26.2-0.1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-marshmallow","fixed_in":["3.26.2-1.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-marshmallow","fixed_in":["3.26.2-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-marshmallow","fixed_in":["3.21.3+root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-marshmallow","fixed_in":["3.20.2-150400.9.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-marshmallow","fixed_in":["3.20.2-150400.9.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-marshmallow","fixed_in":["3.20.2-150400.9.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-marshmallow","fixed_in":["3.20.2-150400.9.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-marshmallow","fixed_in":["3.20.2-150400.9.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-marshmallow","fixed_in":["3.20.2-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-marshmallow","fixed_in":["3.20.2-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-marshmallow","fixed_in":["3.4.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-marshmallow","fixed_in":["3.13.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-marshmallow","fixed_in":["3.20.1-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-marshmallow","fixed_in":["3.26.1-0.4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-marshmallow","fixed_in":["3.26.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-marshmallow","fixed_in":["3.20.2-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0rc1"},{"fixed":"3.26.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.0-1","3.20.1-1","3.20.1-1.1","3.26.1-0.1","3.26.1-0.2","3.26.1-0.3","3.26.1-0.4","3.26.2-0.1","3.26.2-0.2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.2-0+deb13u1"}]}],"versions":["3.26.1-0.2","3.26.1-0.3","3.26.1-0.4"]},{"source":"osv","ecosystem":"Debian:14","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.2-0.1"}]}],"versions":["3.26.1-0.2","3.26.1-0.3","3.26.1-0.4"]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0rc1"},{"fixed":"3.26.2"}]}],"versions":["3.0.0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.0rc6","3.0.0rc7","3.0.0rc8","3.0.0rc9","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.17.0","3.17.1","3.18.0","3.19.0","3.2.0","3.2.1","3.2.2","3.20.0","3.20.1","3.20.2","3.21.0","3.21.1","3.21.2","3.21.3","3.22.0","3.23.0","3.23.1","3.23.2","3.23.3","3.24.0","3.24.1","3.24.2","3.25.0","3.25.1","3.26.0","3.26.1","3.3.0","3.4.0","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.7.0","3.7.1","3.8.0","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}],"versions":["4.0.0","4.0.1","4.1.0","4.1.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.2-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.2-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0rc1"},{"fixed":"3.26.2"},{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}],"versions":["3.0.0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.0rc4","3.0.0rc5","3.0.0rc6","3.0.0rc7","3.0.0rc8","3.0.0rc9","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.15.0","3.16.0","3.17.0","3.17.1","3.18.0","3.19.0","3.2.0","3.2.1","3.2.2","3.20.0","3.20.1","3.20.2","3.21.0","3.21.1","3.21.2","3.21.3","3.22.0","3.23.0","3.23.1","3.23.2","3.23.3","3.24.0","3.24.1","3.24.2","3.25.0","3.25.1","3.26.0","3.26.1","3.3.0","3.4.0","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.7.0","3.7.1","3.8.0","3.9.0","3.9.1","4.0.0","4.0.1","4.1.0","4.1.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3+root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-150400.9.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-150400.9.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-150400.9.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-150400.9.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-150400.9.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b14-1","3.2.1-1","3.2.2-1","3.3.0-1","3.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-1ubuntu0.1~esm1"}]}],"versions":["3.10.0-1","3.13.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.1-1.1ubuntu0.1~esm1"}]}],"versions":["3.18.0-1","3.20.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-0.4","3.26.2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.1-0.4ubuntu0.1~esm1"}]}],"versions":["3.26.1-0.2","3.26.1-0.3","3.26.1-0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0b3-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b3-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1ubuntu0.1~esm1"}]}],"versions":["3.0.0b14-1","3.2.1-1","3.2.2-1","3.3.0-1","3.4.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-1ubuntu0.1~esm1"}]}],"versions":["3.10.0-1","3.13.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.1-1.1ubuntu0.1~esm1"}]}],"versions":["3.18.0-1","3.20.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.1-0.4ubuntu0.1~esm1"}]}],"versions":["3.26.1-0.2","3.26.1-0.3","3.26.1-0.4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-marshmallow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-160000.3.1"}]}]}],"products":[{"vendor":"marshmallow-code","product":"marshmallow"}],"references":[{"url":"https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68480","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-428g-f7cq-pgp5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68480.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68480","tags":["advisory"]},{"url":"https://github.com/marshmallow-code/marshmallow","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3036","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3037","tags":["advisory"]},{"url":"https://pypi.org/project/marshmallow","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255473","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68480","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620130-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68480","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68480","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/218d98a785d3bd25dad8880bb07e9cce70340f31","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/70141f4180fb94ced3544cdefdaff89172dd3956","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/36f87877d0e889e682386a0121eabe030cde57b1","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/0356a3f1c307830f8ded56d823abca5611c594c9","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/6d4a17dad54ea9711040c6aa6ba4d59267242a41","tags":["report"]},{"url":"https://github.com/marshmallow-code/marshmallow/commit/489a8d421dc7955bb53b89e962d69465fbc5b6af","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8225-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-17175","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68480","title":"Marshmallow has DoS in Schema.load(many)","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T21:20:15.958Z","modified":"2025-12-22T21:35:02.469Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-204752","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T21:20:15Z","modified":"2025-12-22T21:35:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:01.709544Z"}],"ghsa":[{"id":"GHSA-428g-f7cq-pgp5","title":"Marshmallow has DoS in Schema.load(many)","description":"### Impact\n\n`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.\n\n### Patches\n\n4.1.2, 3.26.2\n\n### Workarounds\n\n```py\n# Fail fast\ndef load_many(schema, data, **kwargs):\n    if not isinstance(data, list):\n        raise ValidationError(['Invalid input type.'])\n    return [schema.load(item, **kwargs) for item in data]\n```","status":"published","published":"2025-12-22T20:20:07Z","modified":"2025-12-23T16:01:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2025-68480","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T22:16:09.457Z","modified":"2026-10-19T22:10:00.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:11:52.309391Z"}],"osv":[{"id":"CVE-2025-68480","title":"Marshmallow has DoS in Schema.load(many)","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T21:20:15.958Z","modified":"2026-10-28T02:30:47.504078121Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68480","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T22:16:09.457Z","modified":"2026-10-23T18:05:30.584662197Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-428g-f7cq-pgp5","title":"Marshmallow has DoS in Schema.load(many)","description":"### Impact\n\n`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.\n\n### Patches\n\n4.1.2, 3.26.2\n\n### Workarounds\n\n```py\n# Fail fast\ndef load_many(schema, data, **kwargs):\n    if not isinstance(data, list):\n        raise ValidationError(['Invalid input type.'])\n    return [schema.load(item, **kwargs) for item in data]\n```","status":"published","published":"2025-12-22T20:20:07Z","modified":"2026-09-10T03:50:31.208550852Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"OESA-2026-3036","title":"python-marshmallow security update","description":"A lightweight library for converting complex datatypes to and from native Python datatypes.\r\n\r\nSecurity Fix(es):\n\nMarshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.(CVE-2025-68480)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:19.949149365Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3037","title":"python-marshmallow security update","description":"A lightweight library for converting complex datatypes to and from native Python datatypes.\r\n\r\nSecurity Fix(es):\n\nMarshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.(CVE-2025-68480)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:19.97165131Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-1605","title":"Marshmallow has DoS in Schema.load(many)","description":"### Impact\n\n`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.\n\n### Patches\n\n4.1.2, 3.26.2\n\n### Workarounds\n\n```py\n# Fail fast\ndef load_many(schema, data, **kwargs):\n    if not isinstance(data, list):\n        raise ValidationError(['Invalid input type.'])\n    return [schema.load(item, **kwargs) for item in data]\n```","status":"published","published":"2026-07-07T16:03:14.008333Z","modified":"2026-07-07T17:46:15.412219531Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"ROOT-APP-PYPI-CVE-2025-68480","title":"CVE-2025-68480 in rootio-marshmallow - Patched by Root","description":"Root has patched CVE-2025-68480 in the rootio-marshmallow package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-01T08:25:13Z","modified":"2026-07-01T12:34:25.931988311Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2025-68480","description":"Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.","status":"published","published":"2025-12-22T22:16:00Z","modified":"2026-10-17T12:57:39.551233879Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"openSUSE-SU-2026:10003-1","title":"python311-marshmallow-3.26.2-1.1 on GA media","description":"These are all security issues fixed in the python311-marshmallow-3.26.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-03-23T04:54:20.051555Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20087-1","title":"Security update for python-marshmallow","description":"This update for python-marshmallow fixes the following issues:\n\n- CVE-2025-68480: Fixed possible DoS when using Schema.load(data, many=True) (bsc#1255473).\n","status":"published","published":"2026-01-22T15:55:36Z","modified":"2026-03-23T04:54:43.45104Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0226-1","title":"Security update for python-marshmallow","description":"This update for python-marshmallow fixes the following issues:\n\n- CVE-2025-68480: Fixed possible DoS when using Schema.load(data, many=True) (bsc#1255473).\n","status":"published","published":"2026-01-22T12:20:21Z","modified":"2026-03-23T04:51:43.763289Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20130-1","title":"Security update for python-marshmallow","description":"This update for python-marshmallow fixes the following issues:\n\n- CVE-2025-68480: Fixed possible DoS when using Schema.load(data, many=True) (bsc#1255473).\n","status":"published","published":"2026-01-22T15:46:22Z","modified":"2026-03-23T04:52:36.812118Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-8225-1","title":"python-marshmallow vulnerabilities","description":"Jared Deckard discovered that Python marshmallow did not correctly\nhandle hiding certain fields. An attacker could possibly use this issue\nto leak sensitive information. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-17175)\n\nIt was discovered that Python marshmallow did not efficiently handle\nmerging certain objects. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480)","status":"published","published":"2026-04-30T02:19:38Z","modified":"2026-04-30T10:00:02.634492536Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}