CVE-2025-68480: Marshmallow has DoS in Schema.load(many)

December 22, 2025 (updated December 23, 2025)

Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

References

github.com/advisories/GHSA-428g-f7cq-pgp5
github.com/marshmallow-code/marshmallow
github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5
nvd.nist.gov/vuln/detail/CVE-2025-68480

Code Behaviors & Features

Detect and mitigate CVE-2025-68480 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →