Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
marshmallow-code/webargs
dev @ dbd4b72
4
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 3 prior fixes. Scrutinize any change in this area.
setup.py: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Unbounded stream reading in the Falcon parser allows remote attackers to trigger resource exhaustion or application hangs by omitting or misrepresenting the stream size. Ensuring reads are explicitly capped by content length is essential for stream-based parsers.
Race Condition: Concurrency issues in the underlying marshmallow dependency (and internal non-thread-safe JSON parsing caches tracked in CVE-2019-9710) can lead to data contamination or validation bypasses when handling concurrent requests. Strict thread-safe error structures and parsing states must be maintained.
Denial of Service: Dynamic schema generation can lead to unbounded memory growth and memory leak vectors if dynamic classes are repeatedly registered in the global marshmallow class registry. Utilizing anonymous class names prevents registry accumulation.