Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-69534: Python-Markdown 3.8 can crash when handling bad input
CVE-2025-69534 · published 8 months ago
Summary
Versions of Python-Markdown 3.8 used in Python 3.9 and 3.11 can stop working if they receive specially crafted Markdown text. This can cause web sites or documentation tools that render user‑provided Markdown to become unavailable. Upgrade to Python-Markdown 3.8.1 or later to stop the crash.
What to do
- Update manfred stienstra markdown to version 3.8.1.
- Update bellsoft python3 to version 3.11.13-r4.
- Update debian rootio-python3.9 to version 3.9.2-1+deb11u5.root.io.10.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.32.
- Update manfred stienstra markdown to version 3.3.7+aikido.2.
- Update rootio-markdown to version 3.3.7+root.io.2.
- Update rootio-markdown to version 3.4.4+root.io.1.
- Update debian rootio-python3.9 to version 3.9.2-1+deb11u7.root.io.13.
- Update canonical python2.7 to version 2.7.12-1ubuntu0~16.04.18+esm21.
- Update canonical python3.5 to version 3.5.2-2ubuntu0~16.04.13+esm24.
- Update canonical python3.10 to version 3.10.12-1~22.04.16.
- Update canonical python3.12 to version 3.12.3-1ubuntu0.15.
- Update rootio-markdown to version 3.3.7+root.io.1.
- Update debian rootio-python3.9 to version 3.9.2-1+deb11u7.root.io.16.
- Update debian rootio-python3.9 to version 3.9.2-1+deb11u7.aikido.17.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.25.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.28.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.31.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u6.root.io.33.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u7.root.io.34.
- Update debian python3.11 to version 3.11.2-6+deb12u8.aikido.36.
- Update debian rootio-python3.11 to version 3.11.2-6+deb12u8.aikido.36.
- Update python3.11 to version 3.11.2-6+deb12u8.aikido.38.
- Update python3-defaults to version 3.11.2-1.aikido.1.
- Update rootio-python3.11 to version 3.11.2-6+deb12u8.aikido.38.
- Update rootio-python3-defaults to version 3.11.2-1.aikido.1.
- Update python3.9 to version 3.9.2-1+deb11u7.aikido.21.
- Update python3-defaults to version 3.9.2-3.aikido.2.
- Update rootio-python3.9 to version 3.9.2-1+deb11u7.aikido.21.
- Update rootio-python3-defaults to version 3.9.2-3.aikido.2.
- Update python3.9 to version 3.9.2-1+deb11u7.aikido.22.
- Update rootio-python3.9 to version 3.9.2-1+deb11u7.aikido.22.
- Update debian pypy3 to version 8.0.0+dfsg-1.
- Update debian python3.11 to version 3.11.2-6+deb12u9.
- Update debian python3.13 to version 3.13.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | manfred stienstra | markdown |
< 3.8.1 Fix: upgrade to 3.8.1
|
| – | python-markdown | markdown |
3.8 cpe:2.3:a:python-markdown:markdown:3.8:*:*:*:*:python:*:* |
| Alpaquita:23 | bellsoft | python3 |
>= 3.11.3-r0, < 3.11.13-r4 Fix: upgrade to 3.11.13-r4
|
| Root:Debian:11 | debian | rootio-python3.9 |
< 3.9.2-1+deb11u5.root.io.10 < 3.9.2-1+deb11u7.root.io.13 < 3.9.2-1+deb11u7.root.io.16 < 3.9.2-1+deb11u7.aikido.17 Fix: upgrade to 3.9.2-1+deb11u5.root.io.10
|
| Root:Debian:12 | debian | rootio-python3.11 |
< 3.11.2-6+deb12u6.root.io.32 < 3.11.2-6+deb12u6.root.io.25 < 3.11.2-6+deb12u6.root.io.28 < 3.11.2-6+deb12u6.root.io.31 < 3.11.2-6+deb12u6.root.io.33 < 3.11.2-6+deb12u7.root.io.34 < 3.11.2-6+deb12u8.aikido.36 Fix: upgrade to 3.11.2-6+deb12u6.root.io.32
|
| PyPI | manfred stienstra | markdown | <= 3.8 |
| Root:PyPI | manfred stienstra | markdown |
< 3.3.7+aikido.2 Fix: upgrade to 3.3.7+aikido.2
|
| Root:PyPI | – | rootio-markdown |
< 3.3.7+root.io.2 < 3.4.4+root.io.1 < 3.3.7+root.io.1 Fix: upgrade to 3.3.7+root.io.2
|
| Ubuntu:Pro:16.04:LTS | canonical | python2.7 |
< 2.7.12-1ubuntu0~16.04.18+esm21 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+esm21
|
| Ubuntu:Pro:16.04:LTS | canonical | python3.5 |
< 3.5.2-2ubuntu0~16.04.13+esm24 Fix: upgrade to 3.5.2-2ubuntu0~16.04.13+esm24
|
| Ubuntu:22.04:LTS | canonical | python3.10 |
< 3.10.12-1~22.04.16 Fix: upgrade to 3.10.12-1~22.04.16
|
| Ubuntu:24.04:LTS | canonical | python3.12 |
< 3.12.3-1ubuntu0.15 Fix: upgrade to 3.12.3-1ubuntu0.15
|
| BellSoft Hardened Containers:23 | bellsoft | python3 |
>= 3.11.3-r0, < 3.11.13-r4 Fix: upgrade to 3.11.13-r4
|
| Ubuntu:Pro:14.04:LTS | canonical | python2.7 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | python3.4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | python3.5 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python2.7 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python3.6 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python3.7 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python3.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python3.8 | All versions |
| Ubuntu:20.04:LTS | canonical | pypy3 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python2.7 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | python3.9 | All versions |
| Ubuntu:22.04:LTS | canonical | pypy3 | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | python2.7 | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | python3.11 | All versions |
| Ubuntu:24.04:LTS | canonical | pypy3 | All versions |
| Ubuntu:25.10 | canonical | pypy3 | All versions |
| Ubuntu:25.10 | canonical | python3.13 | All versions |
| Ubuntu:25.10 | canonical | python3.14 | All versions |
| Ubuntu:26.04:LTS | canonical | pypy3 | All versions |
| Ubuntu:26.04:LTS | canonical | python3.14 | All versions |
| Root:Debian:12 | debian | python3.11 |
< 3.11.2-6+deb12u8.aikido.36 Fix: upgrade to 3.11.2-6+deb12u8.aikido.36
|
| Root:Debian:12 | – | python3.11 |
< 3.11.2-6+deb12u8.aikido.38 Fix: upgrade to 3.11.2-6+deb12u8.aikido.38
|
| Root:Debian:12 | – | python3-defaults |
< 3.11.2-1.aikido.1 Fix: upgrade to 3.11.2-1.aikido.1
|
| Root:Debian:12 | – | rootio-python3.11 |
< 3.11.2-6+deb12u8.aikido.38 Fix: upgrade to 3.11.2-6+deb12u8.aikido.38
|
| Root:Debian:12 | – | rootio-python3-defaults |
< 3.11.2-1.aikido.1 Fix: upgrade to 3.11.2-1.aikido.1
|
| Root:Debian:11 | – | python3.9 |
< 3.9.2-1+deb11u7.aikido.21 < 3.9.2-1+deb11u7.aikido.22 Fix: upgrade to 3.9.2-1+deb11u7.aikido.21
|
| Root:Debian:11 | – | python3-defaults |
< 3.9.2-3.aikido.2 Fix: upgrade to 3.9.2-3.aikido.2
|
| Root:Debian:11 | – | rootio-python3.9 |
< 3.9.2-1+deb11u7.aikido.21 < 3.9.2-1+deb11u7.aikido.22 Fix: upgrade to 3.9.2-1+deb11u7.aikido.21
|
| Root:Debian:11 | – | rootio-python3-defaults |
< 3.9.2-3.aikido.2 Fix: upgrade to 3.9.2-3.aikido.2
|
| Debian:12 | debian | pypy3 | All versions |
| Debian:14 | debian | pypy3 |
< 8.0.0+dfsg-1 Fix: upgrade to 8.0.0+dfsg-1
|
| Debian:12 | debian | python3.11 |
< 3.11.2-6+deb12u9 Fix: upgrade to 3.11.2-6+deb12u9
|
| Debian:13 | debian | python3.13 |
< 3.13.4-1 Fix: upgrade to 3.13.4-1
|
Original advisory text
CVE-2025-69534 in python3.9 - Patched by Root
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
References
- https://security-tracker.debian.org/tracker/CVE-2025-69534 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2025-69534 Vendor Advisory
- https://github.com/Python-Markdown/markdown/pull/1535
- https://github.com/advisories/GHSA-5wmx-573v-2qwq
- https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89...
- https://nvd.nist.gov/vuln/detail/CVE-2025-69534 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-69534 Third Party Advisory
- https://github.com/python/cpython/commit/76c0b01bc401c3e976011bbc69cec56dbebe0ad... Third Party Advisory
- https://github.com/python/cpython/issues/77057 Third Party Advisory
- https://github.com/python/cpython/commit/aa0c3d1098e7fdcc74b753aadf18dd07ddbc76b... Third Party Advisory
- https://github.com/Python-Markdown/markdown Third Party Advisory
- https://github.com/python/cpython/pull/133834/changes/4fb000658ea11daf9b196c03c8... Third Party Advisory
- https://ubuntu.com/security/notices/USN-8509-1 Vendor Advisory
- https://github.com/python/cpython/commit/381159b2beabbd6b3c0babe4d7ba7fbdeb23ce0... Third Party Advisory
- https://ubuntu.com/security/CVE-2025-69534 Third Party Advisory
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/03/06/4 URL
- https://access.redhat.com/errata/RHSA-2026:10184 Vendor Advisory
- https://github.com/Python-Markdown/markdown/issues/1534 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:13508 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:13512 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:13826 Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69534.json URL
- https://access.redhat.com/errata/RHSA-2026:14835 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:14873 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:14874 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19155 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8614-1 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19366 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:20674 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:20676 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:20677 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:9742 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-69534 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69534... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2444839 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-248Uncaught Exception
CWE-400Uncontrolled Resource Consumption
CWE-617Reachable Assertion
Timeline
Published5 Mar 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
BELL-CVE-2025-69534 · OSV
UBUNTU-CVE-2025-69534 · OSV
CVE-2025-69534 · NVD
GHSA-5wmx-573v-2qwq · GHSA
GHSA-5wmx-573v-2qwq · OSV
CVE-2025-69534 · OSV
PYSEC-2026-89 · OSV
CVE-2025-69534 · MITRE
DEBIAN-CVE-2025-69534 · OSV
Track software like this
Free during beta