CVE-2025-68480: Marshmallow Library DoS Vulnerability

CVE-2025-68480 Overview

CVE-2025-68480 is a denial of service vulnerability in Marshmallow, a lightweight Python library for converting complex objects to and from simple Python datatypes. The flaw affects Schema.load(data, many=True) and allows attackers to send moderately sized payloads that consume disproportionate CPU time. The issue stems from inefficient handling of error store messages during collection processing, categorized under [CWE-405] Asymmetric Resource Consumption. Affected versions include 3.0.0rc1 up to 3.26.2 and 4.0.0 up to 4.1.2. The Marshmallow maintainers released fixes in versions 3.26.2 and 4.1.2.

Critical Impact
Remote unauthenticated attackers can trigger CPU exhaustion in Python applications using Marshmallow schemas to validate list inputs, degrading service availability.

Affected Products

Marshmallow versions 3.0.0rc1 through 3.26.1
Marshmallow versions 4.0.0 through 4.1.1
Python applications using Schema.load() with many=True on untrusted input

Discovery Timeline

2025-12-19 - Marshmallow 4.1.2 released with the fix
2025-12-22 - CVE-2025-68480 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68480

Vulnerability Analysis

Marshmallow serializes and deserializes Python objects for web frameworks and API layers. When applications call Schema.load(data, many=True), Marshmallow iterates through a list of input items and accumulates validation errors in an internal error store. In affected versions, merging error messages rebuilt collection structures on each iteration, producing an algorithmic complexity problem. A modestly sized list of invalid entries forces repeated allocation and traversal, consuming CPU time far beyond what the input size would suggest.

The practical outcome is a denial of service. A single HTTP request carrying a crafted JSON array to any endpoint that deserializes with many=True can pin a worker thread. Multiple concurrent requests can exhaust the application server's process pool.

Root Cause

The root cause is inefficient error aggregation during bulk deserialization. The patch note in the changelog describes the fix as: "Merge error store messages without rebuilding collections." The original implementation reconstructed nested error containers on every merge, producing quadratic or worse behavior relative to the number of items with validation errors.

Attack Vector

Exploitation requires network access to any endpoint that passes user-supplied data into a Marshmallow schema with many=True. No authentication, privileges, or user interaction are required. The attacker submits a list of items designed to trigger validation errors across many fields, forcing the library into its slow error-merge path.

text

// Patch reference from Marshmallow CHANGELOG.rst
+4.1.2 (2025-12-19)
+++++++++++++++++++
+
+Bug fixes:
+
+- :cve:`CVE-2025-68480`: Merge error store messages without rebuilding collections.
+  Thanks 카푸치노 for reporting and :user:`deckar01` for the fix.

Source: Marshmallow commit d24a0c9

Detection Methods for CVE-2025-68480

Indicators of Compromise

Sustained high CPU usage on Python application workers correlating with inbound API traffic
HTTP requests containing large JSON arrays targeting endpoints known to deserialize with many=True
Increased request latency and worker timeouts on endpoints that accept list payloads
Application logs showing repeated ValidationError responses tied to bulk input endpoints

Detection Strategies

Inventory dependencies with pip list or SBOM tooling to identify Marshmallow versions below 3.26.2 or 4.1.2
Enable Python application performance monitoring to flag requests exceeding CPU time thresholds
Add rate limiting and payload size inspection on API gateways in front of endpoints that accept array inputs
Correlate web server access logs with process CPU metrics to identify slow POST or PUT requests to schema-backed endpoints

Monitoring Recommendations

Track per-endpoint p95 and p99 latency to catch algorithmic complexity attacks early
Alert on worker process saturation, thread pool exhaustion, or request queue backlog
Log the size and item count of incoming JSON arrays at the reverse proxy layer

How to Mitigate CVE-2025-68480

Immediate Actions Required

Upgrade Marshmallow to version 3.26.2 (for 3.x deployments) or 4.1.2 (for 4.x deployments)
Audit application code for uses of Schema.load(data, many=True) on user-supplied input
Apply request size limits and item count caps on endpoints that accept list payloads
Deploy rate limiting on API endpoints backed by Marshmallow schemas

Patch Information

The fix is delivered in Marshmallow 3.26.2 and 4.1.2, released on 2025-12-19. See the GitHub Security Advisory GHSA-428g-f7cq-pgp5 and the upstream fix commit.

Workarounds

Enforce a maximum list length at the framework or reverse proxy layer before data reaches Marshmallow
Reject requests exceeding a fixed body size at the load balancer or WAF
Where feasible, validate items individually with many=False inside a bounded loop instead of relying on many=True

bash

# Upgrade Marshmallow to a patched release
pip install --upgrade "marshmallow>=4.1.2"

# Or for 3.x branch deployments
pip install --upgrade "marshmallow>=3.26.2,<4"

# Verify installed version
python -c "import marshmallow; print(marshmallow.__version__)"