PT-2025-17965 · Unknown · Python-Markdownify

Vokiputo · Published 2025-04-26 · Updated 2025-04-27 · CVE-2025-46656

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions python-markdownify (aka markdownify) versions prior to 0.14.1

Description The issue allows large headline prefixes, such as , in addition to the standard

through

tags. This can cause excessive memory consumption.

Recommendations For versions prior to 0.14.1, update to version 0.14.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of large headline prefixes to minimize the risk of excessive memory consumption.

Exploit

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2025-46656

GHSA-7MPR-5M44-H73R

Affected Products

Python-Markdownify

References · 10

• 🔥 https://github.com/matthewwithanm/python-markdownify/issues/143 · Exploit
• https://github.com/matthewwithanm/python-markdownify/compare/0.14.0...0.14.1 · Patch
• https://osv.dev/vulnerability/GHSA-7mpr-5m44-h73r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46656 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46656 · Vendor Advisory
• https://github.com/matthewwithanm/python-markdownify · Note
• https://github.com/matthewwithanm/python-markdownify/commit/959561879693bf4a576f99c6733b50b01186aa08 · Note
• https://t.me/cvetracker/22427 · Telegram Post
• https://twitter.com/CVEnew/status/1916245237032235296 · Twitter Post
• https://t.me/cvedetector/23811 · Telegram Post