What’s Vulnerable › Vulnerabilities

CVE-2019-9710

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-12 · updated 2026-06-17
• Weakness: CWE-362

Description

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests.

Affected products

• Webargs Project Webargs: before 5.1.3 — fixed in 5.1.3

How to fix

Upgrade to a fixed version: Webargs Project Webargs 5.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/marshmallow-code/webargs/issues/371
• https://webargs.readthedocs.io/en/latest/changelog.html
• https://github.com/marshmallow-code/webargs/issues/371
• https://webargs.readthedocs.io/en/latest/changelog.html

Get alerted when CVE-2019-9710 or the next vulnerability affects your stack