CVE-2025-69534
Published: March 10, 2026Last modified: March 13, 2026
Description
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Notes
python3 in 25 LTS and Stream is not affected because its current version 3.12.12 contains the following backported patch: https://github.com/python/cpython/commit/dcf24768c918c41821cda6fe6a1aa20ce26545dd Which also brings the change from the commit that fixes the current CVE: https://github.com/python/cpython/commit/76c0b01bc401c3e976011bbc69cec56dbebe0ad5 Specifically: https://github.com/python/cpython/commit/dcf24768c918c41821cda6fe6a1aa20ce26545dd#diff-da26f443eb16696a27ae56d506f3350528284855872c7fc98cb5a9231550ead8L242
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | python3 | Fixed (3.11.13-r4) |
| 25 LTS | python3 | Not affected (3.12.10-r1) | |
| Stream | python3 | Not affected (3.11.4-r0) | |
| Hardened Containers | 23 LTS | python3 | Fixed (3.11.13-r4) |
| 25 LTS | python3 | Not affected (3.12.10-r1) | |
| Stream | python3 | Not affected (3.11.4-r0) |
References
- http://www.openwall.com/lists/oss-security/2026/03/06/4
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:13508
- https://access.redhat.com/errata/RHSA-2026:13512
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14835
- https://access.redhat.com/errata/RHSA-2026:14873
- https://access.redhat.com/errata/RHSA-2026:14874
- https://access.redhat.com/errata/RHSA-2026:19155
- https://access.redhat.com/errata/RHSA-2026:19366
- https://access.redhat.com/errata/RHSA-2026:20674
- https://access.redhat.com/errata/RHSA-2026:20676
- https://access.redhat.com/errata/RHSA-2026:20677
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2025-69534
- https://bugzilla.redhat.com/show_bug.cgi?id=2444839
- https://github.com/Python-Markdown/markdown
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892
- https://github.com/Python-Markdown/markdown/issues/1534
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json