CVE-2025-68480: 
Python vulnerability analysis and mitigation

CVE-2025-68480 is a denial-of-service (DoS) vulnerability in the Python marshmallow library, affecting Schema.load(data, many=True). A moderately sized request can cause disproportionate CPU consumption, leading to service degradation. Affected versions span from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2. The vulnerability was disclosed on December 22, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is classified as CWE-405 (Asymmetric Resource Consumption / Amplification): the merge_errors function in error_store.py rebuilt error collections (lists and dicts) on every merge operation rather than mutating them in place, causing quadratic or worse CPU growth as the number of items in a many=True load increased. An unauthenticated remote attacker can send a crafted list payload to any API endpoint that calls Schema.load(data, many=True), triggering excessive CPU usage with relatively little input. The fix, applied in commit d24a0c9, changes merge_errors to mutate existing containers in place and adds a copy_containers step to avoid aliasing issues (Github Advisory, Patch Commit).

Successful exploitation results in degraded or complete loss of availability for any service that uses marshmallow's Schema.load(many=True) to process untrusted input. There is no impact on confidentiality or data integrity — the vulnerability is purely a CPU exhaustion issue. Applications with high-throughput APIs or those exposed directly to the internet are at greatest risk of service disruption (Github Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.039–0.106%, indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

1. Reconnaissance: Identify web API endpoints that accept list-type JSON input and are built on Python applications using marshmallow for deserialization (e.g., REST APIs using Flask-Marshmallow, Django REST Framework with marshmallow, etc.).
2. Craft payload: Construct a moderately large JSON array with many items, each containing fields that will trigger validation errors during Schema.load() processing — this maximizes the error merging overhead.
3. Send request: Submit the crafted payload via HTTP POST (or the appropriate method) to the target endpoint. No authentication is required if the endpoint is publicly accessible.
4. Trigger CPU exhaustion: The server's Schema.load(data, many=True) call processes the list and repeatedly invokes merge_errors, consuming disproportionate CPU time relative to the size of the input.
5. Repeat for sustained DoS: Send multiple concurrent or sequential requests to sustain CPU pressure, potentially causing the service to become unresponsive or time out (Github Advisory, Patch Commit).

• Network: Repeated HTTP requests to API endpoints accepting list-type JSON bodies, particularly with large arrays containing many items that trigger validation errors.
• Logs: Application logs showing high volumes of marshmallow ValidationError exceptions or slow request processing times on endpoints using Schema.load(many=True).
• System: Sustained high CPU utilization on the Python application process without a corresponding increase in legitimate traffic; worker process timeouts or restarts in application servers (e.g., gunicorn, uWSGI).

Upgrade marshmallow to version 3.26.2 (for the 3.x branch) or 4.1.2 (for the 4.x branch), which fix the issue by optimizing the merge_errors function to avoid quadratic complexity (Github Advisory). If an immediate upgrade is not possible, the advisory provides a workaround: replace calls to Schema.load(data, many=True) with a custom function that validates the input is a list first and then loads each item individually, failing fast on invalid input types:

def load_many(schema, data, **kwargs):
    if not isinstance(data, list):
        raise ValidationError(['Invalid input type.'])
    return [schema.load(item, **kwargs) for item in data]

Additionally, applying rate limiting and request size limits at the API gateway or web server layer can reduce exposure.

The vulnerability was reported by a researcher identified as "카푸치노" and fixed by maintainer deckar01, as noted in the changelog (Patch Commit). Red Hat, SUSE, Ubuntu, and other Linux distributions have issued advisories or package updates in response. Coverage has been limited to vulnerability tracking platforms and distribution security notices, with no significant broader media or social media discussion observed.