PT-2026-23450 · Unknown · Python-Markdown

Published 2026-03-05 · Updated 2026-05-19 · CVE-2025-69534

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Python-Markdown versions prior to 3.8.1

Description A flaw exists in Python-Markdown version 3.8 where improperly formed HTML-like sequences can trigger an unhandled AssertionError within the html.parser.HTMLParser during Markdown processing. Because Python-Markdown does not handle this exception, applications processing attacker-controlled Markdown may experience crashes. This can lead to a remote, unauthenticated Denial of Service in various systems, including web applications, documentation systems, and CI/CD pipelines that render untrusted Markdown. The issue may also result in Information Disclosure through uncaught exceptions.

Recommendations Update to Python-Markdown version 3.8.1 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-248

Related Identifiers

ALSA-2026:19155

CVE-2025-69534

GHSA-5WMX-573V-2QWQ

PYSEC-2026-89

RHSA-2026:13508

RHSA-2026:13512

RHSA-2026:14835

RHSA-2026:14873

RHSA-2026:14874

RHSA-2026:19155

RHSA-2026:19366

SUSE-SU-2026:0846-1

Affected Products

Python-Markdown

References · 42

• 🔥 https://github.com/Python-Markdown/markdown/issues/1534 · Exploit
• https://ubuntu.com/security/CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69534 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wmx-573v-2qwq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-89 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0846-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2025-69534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69534 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-19155.html · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-69534 · Vendor Advisory