Your message dated Sat, 11 Jul 2026 10:32:48 +0000
with message-id <[email protected]>
and subject line Released in 13.6
has caused the Debian Bug report #1140910,
regarding trixie-pu: package python-marshmallow/3.26.2-0+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140910: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140910
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:python-marshmallow
User: [email protected]
Usertags: pu
* New upstream release.
- CVE-2025-68480: DoS with Schema.load(many) (Closes: #1123888)
The CVE fix is the only non-trivial change in the new upstream version.
diffstat for python-marshmallow-3.26.1 python-marshmallow-3.26.2
CHANGELOG.rst | 8 ++++++++
debian/changelog | 8 ++++++++
pyproject.toml | 4 ++--
src/marshmallow/error_store.py | 35 +++++++++++++++++++++++------------
src/marshmallow/schema.py | 4 ++--
tests/test_error_store.py | 18 +++++++++++++++++-
6 files changed, 60 insertions(+), 17 deletions(-)
diff -Nru python-marshmallow-3.26.1/CHANGELOG.rst
python-marshmallow-3.26.2/CHANGELOG.rst
--- python-marshmallow-3.26.1/CHANGELOG.rst 2025-02-03 17:31:14.000000000
+0200
+++ python-marshmallow-3.26.2/CHANGELOG.rst 2025-12-22 08:51:52.000000000
+0200
@@ -1,6 +1,14 @@
Changelog
---------
+3.26.2 (2025-12-19)
+++++++++++++++++++
+
+Bug fixes:
+
+- :cve:`CVE-2025-68480`: Merge error store messages without rebuilding
collections.
+ Thanks 카푸치노 for reporting and :user:`deckar01` for the fix.
+
3.26.1 (2025-02-03)
*******************
diff -Nru python-marshmallow-3.26.1/debian/changelog
python-marshmallow-3.26.2/debian/changelog
--- python-marshmallow-3.26.1/debian/changelog 2025-03-26 13:58:32.000000000
+0200
+++ python-marshmallow-3.26.2/debian/changelog 2026-06-28 11:20:03.000000000
+0300
@@ -1,3 +1,11 @@
+python-marshmallow (3.26.2-0+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * New upstream release.
+ - CVE-2025-68480: DoS with Schema.load(many) (Closes: #1123888)
+
+ -- Adrian Bunk <[email protected]> Sun, 28 Jun 2026 11:20:03 +0300
+
python-marshmallow (3.26.1-0.2) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru python-marshmallow-3.26.1/pyproject.toml
python-marshmallow-3.26.2/pyproject.toml
--- python-marshmallow-3.26.1/pyproject.toml 2025-02-03 17:31:14.000000000
+0200
+++ python-marshmallow-3.26.2/pyproject.toml 2025-12-22 08:51:52.000000000
+0200
@@ -1,6 +1,6 @@
[project]
name = "marshmallow"
-version = "3.26.1"
+version = "3.26.2"
description = "A lightweight library for converting complex datatypes to and
from native Python datatypes."
readme = "README.rst"
license = { file = "LICENSE" }
@@ -121,7 +121,7 @@
[tool.mypy]
files = ["src", "tests", "examples"]
ignore_missing_imports = true
-warn_unreachable = true
+warn_unreachable = false
warn_unused_ignores = true
warn_redundant_casts = true
no_implicit_optional = true
diff -Nru python-marshmallow-3.26.1/src/marshmallow/error_store.py
python-marshmallow-3.26.2/src/marshmallow/error_store.py
--- python-marshmallow-3.26.1/src/marshmallow/error_store.py 2025-02-03
17:31:14.000000000 +0200
+++ python-marshmallow-3.26.2/src/marshmallow/error_store.py 2025-12-22
08:51:52.000000000 +0200
@@ -18,6 +18,7 @@
# field error -> store/merge error messages under field name key
# schema error -> if string or list, store/merge under _schema key
# -> if dict, store/merge with other top-level keys
+ messages = copy_containers(messages)
if field_name != SCHEMA or not isinstance(messages, dict):
messages = {field_name: messages}
if index is not None:
@@ -25,6 +26,14 @@
self.errors = merge_errors(self.errors, messages)
+def copy_containers(errors):
+ if isinstance(errors, list):
+ return [copy_containers(val) for val in errors]
+ if isinstance(errors, dict):
+ return {key: copy_containers(val) for key, val in errors.items()}
+ return errors
+
+
def merge_errors(errors1, errors2): # noqa: PLR0911
"""Deeply merge two error messages.
@@ -37,24 +46,26 @@
return errors1
if isinstance(errors1, list):
if isinstance(errors2, list):
- return errors1 + errors2
+ errors1.extend(errors2)
+ return errors1
if isinstance(errors2, dict):
- return dict(errors2, **{SCHEMA: merge_errors(errors1,
errors2.get(SCHEMA))})
- return [*errors1, errors2]
+ errors2[SCHEMA] = merge_errors(errors1, errors2.get(SCHEMA))
+ return errors2
+ errors1.append(errors2)
+ return errors1
if isinstance(errors1, dict):
- if isinstance(errors2, list):
- return dict(errors1, **{SCHEMA: merge_errors(errors1.get(SCHEMA),
errors2)})
if isinstance(errors2, dict):
- errors = dict(errors1)
for key, val in errors2.items():
- if key in errors:
- errors[key] = merge_errors(errors[key], val)
+ if key in errors1:
+ errors1[key] = merge_errors(errors1[key], val)
else:
- errors[key] = val
- return errors
- return dict(errors1, **{SCHEMA: merge_errors(errors1.get(SCHEMA),
errors2)})
+ errors1[key] = val
+ return errors1
+ errors1[SCHEMA] = merge_errors(errors1.get(SCHEMA), errors2)
+ return errors1
if isinstance(errors2, list):
return [errors1, *errors2]
if isinstance(errors2, dict):
- return dict(errors2, **{SCHEMA: merge_errors(errors1,
errors2.get(SCHEMA))})
+ errors2[SCHEMA] = merge_errors(errors1, errors2.get(SCHEMA))
+ return errors2
return [errors1, errors2]
diff -Nru python-marshmallow-3.26.1/src/marshmallow/schema.py
python-marshmallow-3.26.2/src/marshmallow/schema.py
--- python-marshmallow-3.26.1/src/marshmallow/schema.py 2025-02-03
17:31:14.000000000 +0200
+++ python-marshmallow-3.26.2/src/marshmallow/schema.py 2025-12-22
08:51:52.000000000 +0200
@@ -374,7 +374,7 @@
class MySchema2(Schema):
# Type checkers will check attributes
- class Meta(Schema.Opts):
+ class Meta(Schema.Meta):
additional = True # Incompatible types in assignment
.. versionremoved:: 3.0.0b7 Remove ``strict``.
@@ -1139,7 +1139,7 @@
msg = (
f'Field for "{field_name}" must be declared as a '
"Field instance, not a class. "
- f'Did you mean "fields.{field_obj.__name__}()"?' # type:
ignore[attr-defined]
+ f'Did you mean "fields.{field_obj.__name__}()"?'
)
raise TypeError(msg) from error
raise
diff -Nru python-marshmallow-3.26.1/tests/test_error_store.py
python-marshmallow-3.26.2/tests/test_error_store.py
--- python-marshmallow-3.26.1/tests/test_error_store.py 2025-02-03
17:31:14.000000000 +0200
+++ python-marshmallow-3.26.2/tests/test_error_store.py 2025-12-22
08:51:52.000000000 +0200
@@ -1,7 +1,7 @@
from typing import NamedTuple
from marshmallow import missing
-from marshmallow.error_store import merge_errors
+from marshmallow.error_store import ErrorStore, merge_errors
def test_missing_is_falsy():
@@ -149,3 +149,19 @@
assert merge_errors(
{"field1": {"field2": "error1"}}, {"field1": {"field2": "error2"}}
) == {"field1": {"field2": ["error1", "error2"]}}
+
+ def test_list_not_changed(self):
+ store = ErrorStore()
+ message = ["foo"]
+ store.store_error(message)
+ store.store_error(message)
+ assert message == ["foo"]
+ assert store.errors == {"_schema": ["foo", "foo"]}
+
+ def test_dict_not_changed(self):
+ store = ErrorStore()
+ message = {"foo": ["bar"]}
+ store.store_error(message)
+ store.store_error(message)
+ assert message == {"foo": ["bar"]}
+ assert store.errors == {"foo": ["bar", "bar"]}
--- End Message ---
--- Begin Message ---
Version: 13.6
This update was released as part of 13.6.
--- End Message ---
