CVE-2025-69534

Aliases:GHSA-5wmx-573v-2qwqPYSEC-2026-89UBUNTU-CVE-2025-69534DEBIAN-CVE-2025-69534CGA-6fjm-xfqj-hmhfCGA-669p-6h36-mw32CGA-68x6-326f-7qgjCGA-w9gx-5hf3-4886CGA-wf9h-5vxv-66mqCGA-xhpg-8vp6-79p9
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 05 Mar 2026, 00:00
Last modified:07 Sept 2026, 12:05

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.57% LOW
1% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

05 Mar 2026, 00:00
Published
Vulnerability first disclosed
07 Sept 2026, 12:05
Last Modified
Vulnerability information updated

Description

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.57%• Percentile: 46%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-617•Reachable Assertion

    The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Systems

  • chainguard•awx

    < 24.6.1-r30

  • chainguard•superset-5.0

    < 5.0.0-r20

  • chainguard•superset-6.0

    < 6.0.0-r4

  • wolfi•superset-6.0

    < 6.0.0-r4

  • debian•pypy3

    all | all | all | all

  • debian•python2.7

    all

  • debian•python3.11

    all

  • debian•python3.13

    < 3.13.4-1 | < 3.13.4-1

  • debian•python3.9

    all

  • ubuntu•pypy3

    all | all | all | all | all

  • ubuntu•python2.7

    all | < 2.7.12-1ubuntu0~16.04.18+esm21

  • ubuntu•python3.10

    < 3.10.12-1~22.04.16

  • ubuntu•python3.11

    all | all

  • ubuntu•python3.12

    < 3.12.3-1ubuntu0.15

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all | < 3.5.2-2ubuntu0~16.04.13+esm24

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • PyPI•markdown

    all | ≤ 3.8 | < 3.8.1

  • python-markdown•markdown

    3.8

References (31)