CVE-2025-69534: python-markdown markdown Uncontrolled Resource Consumption
Vulnerability summary
CVE-2025-69534 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in python-markdown markdown. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 05-03-2026PublishedVulnerability first disclosed.
- 07-09-2026Last modifiedVulnerability information updated.
Description
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMarkdown
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu11 products
- pypy3All versions (No fix recorded)
- python2.7All versions (No fix recorded) | < 2.7.12-1ubuntu0~16.04.18+esm21
- python3.10< 3.10.12-1~22.04.16
- python3.11All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
Chainguard3 products
- awx< 24.6.1-r30
- superset-5.0< 5.0.0-r20
- superset-6.0< 6.0.0-r4
Debian3 products
- pypy3All versions (No fix recorded) | < 8.0.0+dfsg-1
- python3.11< 3.11.2-6+deb12u9
- python3.13< 3.13.4-1
Redhat2 products
- python-markdown< 0:3.5.1-6.el10_2.1 | < 0:3.3.4-4.el9_8.2 | < 0:3.3.4-4.el9_4.2 | < 0:3.3.4-4.el9_6.2 | < 0:3.5.1-6.el10_0.1
- python3-markdown< 0:3.5.1-6.el10_2.1 | < 0:3.3.4-4.el9_8.2 | < 0:3.3.4-4.el9_4.2 | < 0:3.3.4-4.el9_6.2 | < 0:3.5.1-6.el10_0.1
Opensuse1 product
- python-Markdown&distro=openSUSE Leap 15.6< 3.5.2-150600.3.3.1
PyPI1 product
- markdown< 3.8.1 | ≤ 3.8
Python-markdown1 product
- markdown3.8
Wolfi1 product
- superset-6.0< 6.0.0-r4
8 vendors · 23 products
