CVE-2025-68480Medium· 5.3▾ SunlitMarshmallow has DoS in Schema.load(many)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
0.3% → 0.3%
Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.
4.1.2, 3.26.2
# Fail fast
def load_many(schema, data, **kwargs):
if not isinstance(data, list):
raise ValidationError(['Invalid input type.'])
return [schema.load(item, **kwargs) for item in data]
marshmallow >= 3.0.0rc1, < 3.26.2marshmallow >= 4.0.0, < 4.1.2Upgrade to a patched release:
marshmallow 3.26.2marshmallow 4.1.2