PT-2026-23450 · Unknown+2 · Python-Markdown+2

CVE-2025-69534 · Published 2026-03-05 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Python-Markdown versions prior to 3.8.1

Description A flaw exists in Python-Markdown version 3.8 where improperly formed HTML-like sequences can trigger an unhandled AssertionError within the html.parser.HTMLParser during Markdown processing. Because Python-Markdown does not handle this exception, applications processing attacker-controlled Markdown may experience crashes. This can lead to a remote, unauthenticated Denial of Service in various systems, including web applications, documentation systems, and CI/CD pipelines that render untrusted Markdown. The issue may also result in Information Disclosure through uncaught exceptions.

Recommendations Update to Python-Markdown version 3.8.1 or later.

Exploit

Fix

DoS

Resource Exhaustion

Assertion Failure

Weakness Enumeration

CWE-400

CWE-248

CWE-617

Related Identifiers

ALSA-2026:19155

ALSA-2026:19366

CVE-2025-69534

ECHO-3E8B-D85E-69BA

GHSA-5WMX-573V-2QWQ

PYSEC-2026-89

RHSA-2026:13508

RHSA-2026:13512

RHSA-2026:14835

RHSA-2026:14873

RHSA-2026:14874

RHSA-2026:19155

RHSA-2026:19366

RHSA-2026:20674

RHSA-2026:20676

RHSA-2026:20677

SUSE-SU-2026:0846-1

USN-8509-1

USN-8614-1

Affected Products

Linuxmint

Python-Markdown

Rocky Linux

References · 87

• 🔥 https://github.com/Python-Markdown/markdown/issues/1534 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69534.json · Exploit
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-69534 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-19155.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:10184 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8614-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-19366.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9669 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8509-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69534 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69534 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19366 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8509-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69534 · Vendor Advisory