Log in Start free

Vulnerability · Published Mar 5, 2026 · Assigned by mitre

CVE-2025-69534

High 7.5

In plain English

A high-severity uncontrolled resource consumption in the python3-markdown package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-markdown3.5.1-6.el10_2.1ALSA-2026:19155
AlmaLinux:9python3-markdown3.3.4-4.el9_8.2ALSA-2026:19366
Debian:12pypy3no fix listedDEBIAN-CVE-2025-69534
Debian:13pypy3no fix listedDEBIAN-CVE-2025-69534
Debian:14pypy38.0.0+dfsg-1DEBIAN-CVE-2025-69534
Debian:12python3.113.11.2-6+deb12u9DEBIAN-CVE-2025-69534
Debian:13python3.133.13.4-1DEBIAN-CVE-2025-69534
PyPImarkdown3.8.1GHSA-5wmx-573v-2qwq
PyPImarkdownno fix listedPYSEC-2026-89
Rocky Linux:10python-markdown0:3.5.1-6.el10_2.1RLSA-2026:19155
Rocky Linux:9python-markdown0:3.3.4-4.el9_8.2RLSA-2026:19366
Ubuntu:22.04:LTSpypy3no fix listedUBUNTU-CVE-2025-69534
Ubuntu:24.04:LTSpypy3no fix listedUBUNTU-CVE-2025-69534
Ubuntu:25.10pypy3no fix listedUBUNTU-CVE-2025-69534
Ubuntu:26.04:LTSpypy3no fix listedUBUNTU-CVE-2025-69534
Ubuntu:26.10pypy3no fix listedUBUNTU-CVE-2025-69534
Ubuntu:22.04:LTSpython3.103.10.12-1~22.04.16UBUNTU-CVE-2025-69534
Ubuntu:22.04:LTSpython3.103.10.12-1~22.04.16USN-8509-1
Ubuntu:24.04:LTSpython3.123.12.3-1ubuntu0.15UBUNTU-CVE-2025-69534
Ubuntu:24.04:LTSpython3.123.12.3-1ubuntu0.15USN-8509-1
Ubuntu:26.04:LTSpython3.143.14.4-1ubuntu0.1USN-8509-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-400, CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References