ROS-20261019-73-0040

The vulnerability in python-marshmallow relates to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

python313-marshmallow-4.3.0-1.2 on GA media (moderate)

python313-marshmallow-4.3.0-1.2 on GA media Announcement ID: openSUSE-SU-2026:12017-1 Rating: moderate Cross-References: CVE-2018-17175 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

PT-2026-105726

These are all security issues fixed in the python313-marshmallow-4.3.0-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12017-1 python313-marshmallow-4.3.0-1.2 on GA media

These are all security issues fixed in the python313-marshmallow-4.3.0-1.2 package on the GA media of openSUSE Tumbleweed...

Malicious code in elf-stats-whimsical-marshmallow-258 (npm)

Source: amazon-inspector c7a7e133cf8a523d5a833ea5accdefffadfe2b1d6d97f282f7622ebb771a5a16 The package elf-stats-whimsical-marshmallow-258 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-twinkling-marshmallow-913 (npm)

Source: amazon-inspector 14bfada0a37e0ba99a8bc8e8ffeca1569e829cbb3e563a10b93bb64162596b8a The package elf-stats-twinkling-marshmallow-913 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-whimsical-marshmallow-212 (npm)

Source: amazon-inspector c9f8bb3e82efedd679973f65e808bf9581e11d670e777152446fad791bf9f1f7 The package elf-stats-whimsical-marshmallow-212 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-storybook-marshmallow-729 (npm)

Source: amazon-inspector ea9e1e445ab784bb20608d634e3d9e01c84179338478a75b8029624e3ac3b1dd The package elf-stats-storybook-marshmallow-729 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-storybook-marshmallow-471 (npm)

Source: amazon-inspector 8318541f4a7b62093936db71c7578bc5692c0144b3c85eabfc8fa8980f2e2ff5 The package elf-stats-storybook-marshmallow-471 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-snowdusted-marshmallow-228 (npm)

Source: amazon-inspector eab7789ba8f7c654f5e79444be0a76d64268be8478db9d87a97e225d04b26d35 The package elf-stats-snowdusted-marshmallow-228 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-glittering-marshmallow-217 (npm)

Source: amazon-inspector 1c1186083237190f85db3246ab8c84681e053349350324494d5f6dc5cc774b04 The package elf-stats-glittering-marshmallow-217 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in elf-stats-festive-marshmallow-962 (npm)

Source: amazon-inspector 3cb48626e43f888d82ef44f9858aa769226eee250a74781f42ab2e6e9b3714d7 The package elf-stats-festive-marshmallow-962 was found to contain malicious code. --- Credit: OpenSSF source...

Security Bulletin: Vulnerability in marshmallow bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the marshmallow library, which is affected by a denial of service vulnerability. CVE-2025-68480. Vulnerability Details CVEID:CVE-2025-68480 DESCRIPTION: Marshmallow is a lightweight library for converting complex...

OESA-2026-3037 python-marshmallow security update

A lightweight library for converting complex datatypes to and from native Python datatypes. Security Fixes: Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2,...

PYSEC-2026-1605 Marshmallow has DoS in Schema.load(many)

Impact Schema.loaddata, many=True is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. Patches 4.1.2, 3.26.2 Workarounds py Fail fast def loadmanyschema, data, kwargs: if not isinstancedata, list: raise ValidationError'Invalid...

Marshmallow has DoS in Schema.load(many)

ImpactSchema.loaddata, many=True is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. Patches4.1.2, 3.26.2 Workaroundspy Fail fastdef loadmanyschema, data, kwargs: if not isinstancedata, list: raise ValidationError'Invalid input...

acapy-agent (>=1.1.0rc1, <=1.2.7), acapy-agent-jamie-testing (1.0.1) +579 more potentially affected by CVE-2025-68480 via marshmallow (>=3.0.0rc1, <=3.26.1)

marshmallow PYPI version =3.0.0rc1, =1.1.0rc1, =0.1.0, =0.5.6.dev0, =0.1.0.post1, =0.1.5, =4.8.2, =0.1.3, =0.1.31, =0.0.2, =0.0.7, =0.0.5, =0.0.5, =0.3.0 and more Source cves: CVE-2025-68480 Source advisory: OSV:PYSEC-2026-1605...

auto-pr (1.2.0), beer-garden (>=3.0.0.dev1, <=3.35.1) +23 more potentially affected by CVE-2025-68480 via marshmallow (>=4.0.0, <=4.1.1)

marshmallow PYPI version =4.0.0, =3.0.0.dev1, =2.3.1, =3.31.0, =1.8.0, =2.0.3, =3.18.1.dev10, =0.0.1, =1.115.1, =0.0.1, =1.4.5, =6.0.0, =6.25.7 - nvidia-tao-core 6.0.0 and more Source cves: CVE-2025-68480 Source advisory: OSV:PYSEC-2026-1605...

ROOT-APP-PYPI-CVE-2025-68480 CVE-2025-68480 in rootio-marshmallow - Patched by Root

Root has patched CVE-2025-68480 in the rootio-marshmallow package for Root:PyPI. Multiple fixed versions available...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Python marshmallow vulnerabilities (USN-8225-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8225-1 advisory. Jared Deckard discovered that Python marshmallow did not correctly handle hiding certain fields. An...