CVE-2025-69534
EUVD-2025-20831205.03.2026, 15:16
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| python-markdown | markdown | 3.8 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.10.2-1.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.10.2-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.11-2.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:3.10.2-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 0:3.5.1-6.el10_2.1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:3.5.1-6.el10_0.1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:3.3.4-4.el9_8.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | 0:3.3.4-4.el9_4.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:3.3.4-4.el9_6.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:3.8.2-1.el8pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:3.8.2-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:3.8.2-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:3.8.2-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776768939 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776243287 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776272253 ≤ 𝑥 < * | ADP |
Debian Releases
Debian Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| pypy3 |
| ||||||||||||
| python2.7 |
| ||||||||||||
| python3.11 |
| ||||||||||||
| python3.13 |
| ||||||||||||
| python3.14 |
| ||||||||||||
| python3.9 |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| pypy3 |
| ||||||||||||||||
| python2.7 |
| ||||||||||||||||
| python3.5 |
| ||||||||||||||||
| python3.10 |
| ||||||||||||||||
| python3.12 |
| ||||||||||||||||
| python3.13 |
| ||||||||||||||||
| python3.14 |
| ||||||||||||||||
| python3.11 |
| ||||||||||||||||
| python3.4 |
| ||||||||||||||||
| python3.6 |
| ||||||||||||||||
| python3.7 |
| ||||||||||||||||
| python3.8 |
| ||||||||||||||||
| python3.9 |
|
Amazon Linux Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-617 - Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
References