CVE-2025-68480
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.
- CVSS 3.1
- 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-25)
- CWE
- CWE-405
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-428g-f7cq-pgp5 | PyPI | marshmallow | >=3.0.0rc1 <3.26.2 | 3.26.2 |
| GHSA-428g-f7cq-pgp5 | PyPI | marshmallow | >=4.0.0 <4.1.2 | 4.1.2 |
| PYSEC-2026-1605 | PyPI | marshmallow | >=3.0.0rc1 <3.26.2 >=4.0.0 <4.1.2 | 3.26.2, 4.1.2 |