Most recent entries from all

BREW-cobo-cli-CVE-2025-68480 — Marshmallow has DoS in Schema.load(many)

Affected: Homebrew: cobo-cli

### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py # Fail fast def load_many(schema, data, **kwargs): if not isinstance(data, list): raise ValidationError(['Invalid input type.']) return [schema.load(item, **kwargs) for item in data] ```

certfr-2026-avi-0224 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0224

Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-264270

fkie_cve-2025-68480

Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.

GHSA-428g-f7cq-pgp5 — Marshmallow has DoS in Schema.load(many)

Affected: PyPI: marshmallow

### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py # Fail fast def load_many(schema, data, **kwargs): if not isinstance(data, list): raise ValidationError(['Invalid input type.']) return [schema.load(item, **kwargs) for item in data] ```

OESA-2026-3036 — python-marshmallow security update

Affected: openEuler:24.03-LTS-SP3: python-marshmallow

A lightweight library for converting complex datatypes to and from native Python datatypes. Security Fix(es):

openSUSE-SU-2026:10003-1 — python311-marshmallow-3.26.2-1.1 on GA media

python311-marshmallow-3.26.2-1.1 on GA media

PYSEC-2026-1605 — Marshmallow has DoS in Schema.load(many)

Affected: PyPI: marshmallow

### Impact

`Schema.load(data, many=True)` is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time.

### Patches

4.1.2, 3.26.2

### Workarounds

```py # Fail fast def load_many(schema, data, **kwargs): if not isinstance(data, list): raise ValidationError(['Invalid input type.']) return [schema.load(item, **kwargs) for item in data] ```

SUSE-SU-2026:20130-1 — Security update for python-marshmallow

Security update for python-marshmallow

UBUNTU-CVE-2025-68480

Affected: Ubuntu:Pro:20.04:LTS: python-marshmallow, Ubuntu:Pro:22.04:LTS: python-marshmallow, Ubuntu:Pro:24.04:LTS: python-marshmallow, Ubuntu:25.10: python-marshmallow, Ubuntu:Pro:26.04:LTS: python-marshmallow

WID-SEC-W-2026-2451 — Oracle Siebel CRM: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.