---
id: CVE-2025-68480
aliases:
  - GHSA-428g-f7cq-pgp5
  - PYSEC-2026-1605
title: Marshmallow has DoS in Schema.load(many)
summary: Marshmallow has DoS in Schema.load(many)
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
vendor: marshmallow
product: marshmallow
ecosystem: pip
affected:
  - 'marshmallow >= 3.0.0rc1, < 3.26.2'
  - 'marshmallow >= 4.0.0, < 4.1.2'
patched:
  - marshmallow 3.26.2
  - marshmallow 4.1.2
published: '2025-12-22'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:31.208550852Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-428g-f7cq-pgp5'
references:
  - url: >-
      https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68480'
  - url: >-
      https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
  - url: 'https://github.com/marshmallow-code/marshmallow'
tags:
  - osv
  - pip
epss: 0.00296
epssPercentile: 0.19785
ingestedAt: '2026-07-08T18:25:45.226Z'
---

## Overview

### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py
# Fail fast
def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]
```

## Affected packages

- `marshmallow >= 3.0.0rc1, < 3.26.2`
- `marshmallow >= 4.0.0, < 4.1.2`

## Remediation

Upgrade to a patched release:

- `marshmallow 3.26.2`
- `marshmallow 4.1.2`