high 8.2

CVE-2025-69534 json

Python-Markdown has an Uncaught Exception

published 2026-03-05 8 mo ago modified 2026-09-10 1 mo ago also GHSA-5wmx-573v-2qwq , PYSEC-2026-89 , EUVD-2025-208312

cvss: 8.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

Patch / fix

fixed in 16 distros 6 links 1

pypi markdown 3.8.1
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:3.10.2-1.el8ap
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:3.10.2-1.el9ap
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:3.10.2-1.el9ap, 0:4.7.11-2.el9ap
Red Hat Red Hat Enterprise Linux 10 0:3.5.1-6.el10_2.1
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.5.1-6.el10_0.1
Red Hat Red Hat Enterprise Linux 9 0:3.3.4-4.el9_8.2
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:3.3.4-4.el9_4.2
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.3.4-4.el9_6.2
Red Hat Red Hat Satellite 6.16 for RHEL 8 0:3.8.2-1.el8pc
Red Hat Red Hat Satellite 6.16 for RHEL 9 0:3.8.2-1.el9pc
Red Hat Red Hat Satellite 6.17 for RHEL 9 0:3.8.2-1.el9pc
Red Hat Red Hat Satellite 6.18 for RHEL 9 0:3.8.2-1.el9pc
Red Hat Red Hat Developer Hub 1.8 1776784286
Red Hat Red Hat Developer Hub 1.9 1777903262
Red Hat Red Hat OpenShift AI 2.25 1776243287, 1776272253, 1776768939

debian ubuntu red hat suse almalinux rocky linux

pypy3 Debian 14 8.0.0+dfsg-1
python3.11 Debian 12 3.11.2-6+deb12u9
python3.13 Debian 13 3.13.4-1

debian advisories DEBIAN-CVE-2025-69534

python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.16
python3.12 Ubuntu 24.04 LTS 3.12.3-1ubuntu0.15
python2.7 Ubuntu Pro 16.04 LTS 2.7.12-1ubuntu0~16.04.18+esm21
python3.5 Ubuntu Pro 16.04 LTS 3.5.2-2ubuntu0~16.04.13+esm24

ubuntu advisories UBUNTU-CVE-2025-69534

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-markdown RHEL 9 3.3.4-4.el9_8.2
python3-markdown RHEL 9 3.3.4-4.el9_8.2
python-markdown RHEL 10.2 3.5.1-6.el10_2.1
python3-markdown RHEL 10.2 3.5.1-6.el10_2.1
candlepin satellite 6.16 4.4.25-1.el8sat
candlepin satellite 6.17, satellite 6.16 4.4.25-1.el9sat
python-pillow satellite capsule 6.16, satellite 6.16 12.1.1-1.el8pc
python-pillow satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 12.1.1-1.el9pc

red hat advisories RHSA-2026:20677 RHSA-2026:20674 RHSA-2026:20676 RHSA-2026:19366 RHSA-2026:19155 RHSA-2026:14874

python-Markdown openSUSE Leap 15.6 3.5.2-150600.3.3.1

suse advisories SUSE-SU-2026:0846-1

python3-markdown AlmaLinux 10 3.5.1-6.el10_2.1
python3-markdown AlmaLinux 9 3.3.4-4.el9_8.2

almalinux advisories ALSA-2026:19155 ALSA-2026:19366

python-markdown Rocky Linux 10 3.5.1-6.el10_2.1
python-markdown Rocky Linux 9 3.3.4-4.el9_8.2

rocky linux advisories RLSA-2026:19155 RLSA-2026:19366

github.com/Python-Markdown/markdown#1535 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-69534 updated 2026-11-04 cvss 8.2

python-markdown: denial of service via malformed HTML-like sequences

Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/controller-rhel9
affected: workaround, no fix available “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.”
Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-runtime-adapter-rhel8, rhoai/odh-training-rocm62-torch24-py311-rhel9, rhoai/odh-training-cuda121-torch24-py311-rhel9
affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.”
Red Hat Satellite 6 python-markdown, python3-markdown
affected: workaround, no fix available “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.”
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-markdown 3.10.2-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-markdown 3.10.2-1.el9ap
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:13512
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-markdown 3.10.2-1.el9ap, automation-controller 4.7.11-2.el9ap, automation-controller-ui 4.7.11-2.el9ap, automation-controller-cli 4.7.11-2.el9ap, automation-controller-server 4.7.11-2.el9ap, automation-controller-venv-tower 4.7.11-2.el9ap
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:13508
Red Hat Developer Hub 1.8 rhdh 1776784286
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:9742
Red Hat Developer Hub 1.9 rhdh 1777903262
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:13826
Red Hat Enterprise Linux BaseOS (v. 9) python-markdown 3.3.4-4.el9_8.2, python3-markdown 3.3.4-4.el9_8.2
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:19366

show 11 more

Red Hat Enterprise Linux BaseOS (v. 10) python-markdown 3.5.1-6.el10_2.1, python3-markdown 3.5.1-6.el10_2.1
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:19155
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-markdown 3.5.1-6.el10_0.1, python3-markdown 3.5.1-6.el10_0.1
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:20677
Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-markdown 3.3.4-4.el9_4.2, python3-markdown 3.3.4-4.el9_4.2
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:20674
Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-markdown 3.3.4-4.el9_6.2, python3-markdown 3.3.4-4.el9_6.2
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:20676
Red Hat OpenShift AI 2.25 rhoai 1776243287, rhoai 1776272253, rhoai 1776768939
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:10184
Red Hat Satellite 6.16 for RHEL 8 python-markdown 3.8.2-1.el8pc, python3.11-markdown 3.8.2-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-markdown 3.8.2-1.el9pc, python3.11-markdown 3.8.2-1.el9pc
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:14874
Red Hat Satellite 6.17 for RHEL 9 python-markdown 3.8.2-1.el9pc, python3.11-markdown 3.8.2-1.el9pc
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:14873
Red Hat Satellite 6.18 for RHEL 9 python3.12-markdown 3.8.2-1.el9pc
fixed: vendor fix “To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak.” RHSA-2026:14835
Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-installer-rhel9, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/assisted-installer-agent-rhel9, multicluster-engine/assisted-installer-controller-rhel9 Red Hat Ansible Automation Platform 2 python-markdown, ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.4-2.el8ap, yamllint 1.38.0-1.el8ap, receptorctl 1.6.4-2.el8ap, ansible-lint 26.1.1-1.el8ap, ansible-core 2.16.18-1.el8ap, ansible-test 2.16.18-1.el8ap, +43 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +43 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +41 more

+7 more productsfewer

Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.4-3.el10ap, yamllint 1.38.0-2.el10ap, receptorctl 1.6.4-3.el10ap, ansible-lint 26.1.1-2.el10ap, python-black 26.3.1-2.el10ap, ansible-core 2.16.18-2.el10ap, +7 more Red Hat Developer Hub 1.8 rhdh 1776783947, rhdh 1776787729 Red Hat Developer Hub 1.9 rhdh 1777902709, rhdh 1777909942 Red Hat Enterprise Linux 6 python-markdown Red Hat Enterprise Linux 8 python3-markdown Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-built-in-detector-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-training-rocm64-torch28-py312-rhel9, +12 more Red Hat OpenShift AI 2.25 rhoai 1775144403, rhoai 1776243157, rhoai 1776243163, rhoai 1776243192, rhoai 1776243217, rhoai 1776243229, +68 more

not affected: vulnerable code not present
Red Hat OpenShift Container Platform 4 openshift4/ose-olm-catalogd-rhel9, openshift4/ose-agent-installer-api-server-rhel9
not affected: component not present
Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9 Red Hat Satellite 6 satellite/iop-advisor-backend-rhel9 Red Hat Satellite 6.16 for RHEL 8 candlepin 4.4.25-1.el8sat, satellite 6.16.8-1.el8sat, foreman 3.12.0.15-1.el8sat, python-pillow 12.1.1-1.el8pc, satellite-cli 6.16.8-1.el8sat, foreman-cli 3.12.0.15-1.el8sat, +25 more Red Hat Satellite 6.16 for RHEL 9 candlepin 4.4.25-1.el9sat, satellite 6.16.8-1.el9sat, foreman 3.12.0.15-1.el9sat, python-pillow 12.1.1-1.el9pc, satellite-cli 6.16.8-1.el9sat, foreman-cli 3.12.0.15-1.el9sat, +25 more Red Hat Satellite 6.17 for RHEL 9 candlepin 4.4.25-1.el9sat, satellite 6.17.8-1.el9sat, foreman 3.14.0.16-1.el9sat, python-pillow 12.1.1-1.el9pc, satellite-cli 6.17.8-1.el9sat, foreman-cli 3.14.0.16-1.el9sat, +26 more Red Hat Satellite 6.18 for RHEL 9 candlepin 4.6.5-1.el9sat, satellite 6.18.5-1.el9sat, foreman 3.16.0.16-1.el9sat, python3.12-cffi 2.0.0-1.el9pc, satellite-cli 6.18.5-1.el9sat, foreman-cli 3.16.0.16-1.el9sat, +27 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago (2026-03-12)

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/Python-Markdown/markdown/issues/1534 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	markdown	<3.8.1 <=3.8	3.8.1

Affected products

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat Red Hat Satellite 6.16 for RHEL 8
Red Hat Red Hat Satellite 6.16 for RHEL 9
Red Hat Red Hat Satellite 6.17 for RHEL 9
Red Hat Red Hat Satellite 6.18 for RHEL 9
Red Hat Red Hat Developer Hub 1.8
Red Hat Red Hat Developer Hub 1.9
Red Hat Red Hat OpenShift AI 2.25
Red Hat External Secrets Operator for Red Hat OpenShift
Red Hat Multicluster Engine for Kubernetes
Red Hat Red Hat Ansible Automation Platform 2
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat OpenShift AI (RHOAI)
Red Hat Red Hat OpenShift Container Platform 4
Red Hat Red Hat OpenShift Dev Spaces
Red Hat Red Hat Satellite 6

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-617 Reachable Assertion
CWE-248 Uncaught Exception

References

github.com /Python-Markdown/markdown/pull/1535
web
github.com /Python-Markdown/markdown/issues/1534
web, exploit, issue-tracking, report
access.redhat.com /errata/RHSA-2026:13512
vendor-advisory
access.redhat.com /errata/RHSA-2026:14874
vendor-advisory
access.redhat.com /errata/RHSA-2026:13508
vendor-advisory
access.redhat.com /errata/RHSA-2026:14873
vendor-advisory
access.redhat.com /errata/RHSA-2026:14835
vendor-advisory
access.redhat.com /errata/RHSA-2026:20677
vendor-advisory
access.redhat.com /errata/RHSA-2026:19155
vendor-advisory
access.redhat.com /errata/RHSA-2026:20674
vendor-advisory
access.redhat.com /errata/RHSA-2026:20676
vendor-advisory
access.redhat.com /errata/RHSA-2026:19366
vendor-advisory
access.redhat.com /errata/RHSA-2026:9742
vendor-advisory
access.redhat.com /errata/RHSA-2026:13826
vendor-advisory
access.redhat.com /errata/RHSA-2026:10184
vendor-advisory
github.com /Python-Markdown/markdown
web, product, package
github.com /Python-Markdown/markdown/actions/runs/15736122892
web, product
openwall.com /lists/oss-security/2026/03/06/4
web, mailing-list, third-party-advisory, advisory
access.redhat.com /security/cve/CVE-2025-69534
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=2444839
issue-tracking
security.access.redhat.com /data/csaf/v2/vex/2025/cve-2025-69534.json
nvd.nist.gov /vuln/detail/CVE-2025-69534
advisory
github.com /pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml
web
github.com /advisories/GHSA-5wmx-573v-2qwq
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary