CVE-2025-68480: marshmallow-code marshmallow
CVSS: 5.3v3.1MediumDeferred
AliasesSUSE-SU-2026:0226-1SUSE-SU-2026:20130-1GHSA-428g-f7cq-pgp5PYSEC-2026-1605UBUNTU-CVE-2025-68480DEBIAN-CVE-2025-68480CGA-45gm-4qv8-2wgqCGA-76cf-6338-29wvCGA-84f3-cvx5-hqqfCGA-8pgj-8hpq-w49wCGA-9qjw-6fgx-hm26CGA-g7m4-j8rc-vq7gCGA-gp39-42gr-vr9fCGA-jrv9-95r7-hrv4CGA-m54x-p92p-53cmCGA-mmvp-58xh-m3jcCGA-mwpq-c626-437fCGA-p5v6-7hhp-39g6CGA-pv3j-pgh4-h2pgCGA-qcpj-v33r-f39wCGA-qvj8-6gvp-x8pfCGA-qxm2-v3gw-m7v4openSUSE-SU-2026:10003-1openSUSE-SU-2026:20087-1CGA-33jq-fp5r-vhj8CGA-6wf2-73hm-3x4hCGA-745v-85jq-rrpqCGA-7pj4-rjh8-c629CGA-842f-4gvr-c2chCGA-859m-p745-fh86CGA-93mv-w3xm-36cjCGA-97g7-4x45-mrfmCGA-98w3-2m3m-pjmcCGA-9g64-x5x8-68g2CGA-9rx9-j56r-m9wvCGA-c8mg-2wwq-7h3pCGA-cvqp-6qp6-p84vCGA-fhjm-rwqr-22j8CGA-fxrr-wgxx-2c8hCGA-g7h9-j7wr-rw2mCGA-j3hq-jf8q-97jpCGA-mc7w-w95w-8cfmCGA-mj3m-v8c3-m4c9CGA-mwvh-x3hw-vq45CGA-p7w9-6cg4-7chmCGA-ppgm-rqxw-73pvCGA-q687-46hm-6ggwCGA-rh4x-4ppg-c82qCGA-vqjq-jh79-hxh6CGA-vwq7-xw92-9ww9CGA-whpj-rghq-78rfCGA-xx5w-vrr6-hvp5
Published 22-12-2025Last modified 22-12-2025
Vulnerability summary
CVE-2025-68480 is a medium (CVSS 5.3) vulnerability in marshmallow-code marshmallow. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 20.8% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 6Timeline
- 22-12-2025PublishedVulnerability first disclosed.
- 22-12-2025Last modifiedVulnerability information updated.
Description
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 18-09-2026
18-09-202618-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard21 products
- airflow-2< 2.11.0-r18
- airflow-2-bitnami-compat< 2.11.0-r18
- airflow-2-compat< 2.11.0-r18
- airflow-2-iamguarded-compat< 2.11.0-r18
- airflow-3< 3.1.5-r1
Wolfi7 products
- airflow-3< 3.1.5-r1
- airflow-3-bitnami-compat< 3.1.5-r1
- airflow-3-compat< 3.1.5-r1
- airflow-3-iamguarded-compat< 3.1.5-r1
- ggshield< 1.51.0-r0 | < 1.49.0-r1
Suse6 products
- python-marshmallow&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.20.2-150400.9.10.1
- python-marshmallow&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 3.20.2-150400.9.10.1
- python-marshmallow&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 3.20.2-150400.9.10.1
- python-marshmallow&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP7< 3.20.2-150400.9.10.1
- python-marshmallow&distro=SUSE Linux Enterprise Server 16.0< 3.20.2-160000.3.1
Opensuse3 products
- python-marshmallow&distro=openSUSE Leap 15.6< 3.20.2-150400.9.10.1
- python-marshmallow&distro=openSUSE Leap 16.0< 3.20.2-160000.3.1
- python-marshmallow&distro=openSUSE Tumbleweed< 3.26.2-1.1
Debian1 product
- python-marshmallowAll versions (No fix recorded) | < 3.26.2-0+deb13u1 | < 3.26.2-0.1
Marshmallow-code1 product
- marshmallow≥ 3.0.0rc1, < 3.26.2 | ≥ 4.0.0, < 4.1.2
PyPI1 product
- marshmallow≥ 3.0.0rc1, < 3.26.2 | ≥ 4.0.0, < 4.1.2
Ubuntu1 product
- python-marshmallow< 3.4.0-1ubuntu0.1~esm1 | < 3.13.0-1ubuntu0.1~esm1 | < 3.20.1-1.1ubuntu0.1~esm1 | All versions (No fix recorded) | < 3.26.1-0.4ubuntu0.1~esm1
8 vendors · 41 products
References
21 links- github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5X Refsource CONFIRMWEBREPORTAdvisory
- github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508X Refsource MISCWEBREPORTFIX
- pypi.org/project/marshmallowPACKAGE
