Deserialization in Marsupialtail Quokka
CVE-2025-62515
pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or vali…
Vulnerability class: Insecure Deserialization
EPSS: 0.008 (50.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Marsupialtail Quokka — versions <= 3.0.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2025-62515?
- CVE-2025-62515 is a critical-severity vulnerability in Marsupialtail Quokka, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-17.
- How severe is CVE-2025-62515?
- Critical severity. CVSS v3 base score is 9.8 out of 10.