Asymmetric Resource Consumption (Amplification) in marshmallow - CVE-2025-68480

Vulnerability identifier: #VU123562

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-68480

CWE-ID: CWE-405

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a moderately sized request can consume a disproportionate amount of CPU time. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

marshmallow
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
openSUSE Leap
openEuler
watsonx Code Assistant On Prem
python311-marshmallow
python-marshmallow
python-marshmallow-help
python3-marshmallow

Install updates from vendor's website.

marshmallow - addressed in versions 3.26.2, 4.1.2
watsonx Code Assistant On Prem - update to 5.3.1
python311-marshmallow - update to 3.20.2-150400.9.10.1
python-marshmallow - update to 3.26.2-1
python-marshmallow-help - update to 3.26.2-1
python3-marshmallow - update to 3.26.2-1

• https://github.com/marshmallow-code/marshmallow/commit/d24a0c9df061c4daa92f71cf85aca25b83eee508
• https://github.com/marshmallow-code/marshmallow/security/advisories/GHSA-428g-f7cq-pgp5

• Asymmetric Resource Consumption (Amplification) in Marshmallow
• SUSE update for python-marshmallow
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• openEuler 24.03 LTS SP1 update for python-marshmallow
• openEuler 24.03 LTS SP3 update for python-marshmallow