PYSEC-2026-1605
Marshmallow has DoS in Schema.load(many)
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-68480
- Alias
- GHSA-428g-f7cq-pgp5
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
### Impact `Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. ### Patches 4.1.2, 3.26.2 ### Workarounds ```py # Fail fast def load_many(schema, data, **kwargs): if not isinstance(data, list): raise ValidationError(['Invalid input type.']) return [schema.load(item, **kwargs) for item in data] ```
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · marshmallow | introduced 3.0.0rc1, fixed 3.26.2, introduced 4.0.0, fixed 4.1.2 |
Références
- https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-68480 ADVISORY
- https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508 WEB
- https://github.com/marshmallow-code/marshmallow PACKAGE
- https://pypi.org/project/marshmallow PACKAGE
- https://github.com/advisories/GHSA-428g-f7cq-pgp5 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |