Denial of Service Vulnerability in Marshmallow Package
Summary
GHSA-428g-f7cq-pgp5: Marshmallow has DoS in Schema.load(many). Affects marshmallow across 2 version ranges.
>= 3.0.0rc1, < 3.26.2
>= 4.0.0, < 4.1.2
Fixed in 3.26.2 or 4.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Marshmallow is a popular Python library used for object serialization and deserialization, allowing developers to convert complex data types, such as objects, into JSON and vice versa. It provides features like data validation and schema definition, making it a valuable tool for API development. However, a recent vulnerability has been identified in the Schema.load method when processing multiple inputs, which can lead to significant performance issues.
Vulnerability Detail
The vulnerability arises from the Schema.load(data, many=True) method, which is susceptible to denial of service (DoS) attacks. When a moderately sized request is processed, it can consume an excessive amount of CPU resources, potentially leading to application slowdowns or crashes. This issue is classified under CWE-405, which pertains to the 'Concurrent Execution using Shared Resource with Improper Synchronization.' The vulnerability affects versions of Marshmallow starting from 3.0.0rc1 up to 3.26.1 and 4.0.0 up to 4.1.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0rc1, < 3.26.23.26.2pip install --upgrade "marshmallow==3.26.2" -
>= 4.0.0, < 4.1.24.1.2pip install --upgrade "marshmallow==4.1.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can implement the following code to fail fast when invalid input types are detected:
# Fail fast
def load_many(schema, data, **kwargs):
if not isinstance(data, list):
raise ValidationError(['Invalid input type.'])
return [schema.load(item, **kwargs) for item in data]
Conclusion
The identified denial of service vulnerability in the Marshmallow package poses a risk to applications that rely on the Schema.load method for processing multiple inputs. It is crucial for developers to update to the latest patched versions or implement the suggested workaround to mitigate the risk.
See every vulnerability recorded for marshmallow →
FAQ
The vulnerability is a denial of service (DoS) issue that can cause excessive CPU usage when processing multiple inputs in the Schema.load method.
Versions of Marshmallow from 3.0.0rc1 to 3.26.1 and from 4.0.0 to 4.1.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If you cannot update the package immediately, consider implementing the provided workaround to validate input types and prevent potential DoS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for marshmallow.
