{"id":"CVE-2025-68480","aliases":["GHSA-428g-f7cq-pgp5","PYSEC-2026-1605"],"title":"Marshmallow has DoS in Schema.load(many)","summary":"Marshmallow has DoS in Schema.load(many)","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"marshmallow","product":"marshmallow","ecosystem":"pip","affected":["marshmallow >= 3.0.0rc1, < 3.26.2","marshmallow >= 4.0.0, < 4.1.2"],"patched":["marshmallow 3.26.2","marshmallow 4.1.2"],"published":"2025-12-22","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:31.208550852Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-428g-f7cq-pgp5","references":[{"url":"https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68480"},{"url":"https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508"},{"url":"https://github.com/marshmallow-code/marshmallow"}],"tags":["osv","pip"],"epss":0.00296,"epssPercentile":0.22501,"ingestedAt":"2026-07-08T18:25:45.226Z","slug":"CVE-2025-68480","body":"## Overview\n\n### Impact\n\n`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.\n\n### Patches\n\n4.1.2, 3.26.2\n\n### Workarounds\n\n```py\n# Fail fast\ndef load_many(schema, data, **kwargs):\n    if not isinstance(data, list):\n        raise ValidationError(['Invalid input type.'])\n    return [schema.load(item, **kwargs) for item in data]\n```\n\n## Affected packages\n\n- `marshmallow >= 3.0.0rc1, < 3.26.2`\n- `marshmallow >= 4.0.0, < 4.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `marshmallow 3.26.2`\n- `marshmallow 4.1.2`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}