High severity · published Mar 5, 2026
CVE-2025-69534
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Markdown · Python-markdown
3.8 · source: NVD
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Developer Hub 1.8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Developer Hub 1.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9.4 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9.6 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69534
Product
https://github.com/Python-Markdown/markdown
Product
https://github.com/Python-Markdown/markdown/actions/runs/15736122892
Exploit
https://github.com/Python-Markdown/markdown/issues/1534
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/06/4
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10184
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13508
