# PYSEC-2019-69 - An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON…

Source: https://junglewise.ai/threats/pysec-2019-69-an-issue-was-discovered-in-webargs-before-5-1-3-as-used-f4bacbd0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-03-12  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-03-12

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests.

Technologies: [webargs (PyPI)](https://junglewise.ai/threats/technologies/webargs). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 12 March 2019.

**Which products and versions are affected?** webargs (PyPI) ECOSYSTEM:introduced=0,fixed=5.1.3.

**Is there a fix for This vulnerability?** Yes. webargs (PyPI): upgrade to 5.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run webargs (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- webargs (PyPI): upgrade to 5.1.3 or later

  ```sh
  pip install "webargs>=5.1.3"
  ```


## Affected products

- webargs (PyPI) ECOSYSTEM:introduced=0,fixed=5.1.3

## Related threats

- [Cross-Site Request Forgery in Webargs](https://junglewise.ai/threats/cve-2020-7965-cross-site-request-forgery-in-webargs)
- [Webargs mishandles concurrent JSON parsing](https://junglewise.ai/threats/cve-2019-9710-webargs-mishandles-concurrent-json-parsing)