Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences…
Priority HIGH 72CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00663 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Markdown (PyPI): 3.8.1Red Hat: 13 advisoriesRed Hat: 15 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Markdown (PyPI) | before 3.8.1 | 3.8.1 | Patch available | GHSA-5wmx-573v-2qwq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Markdown (PyPI) Vendor— Affected before 3.8.1 Fixed in 3.8.1 Patch available GHSA-5wmx-573v-2qwq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python-markdown:markdown:3.8:*:*:*:*:python:*:* | 3.8 | Vulnerable | Python-Markdown |
- cpe:2.3:a:python-markdown:markdown:3.8:*:*:*:*:python:*:* Versions 3.8 Vulnerable ·Python-Markdown
Remediation
- Fix · GHSA-5wmx-573v-2qwq Markdown (PyPI) Fixed in 3.8.1 Advisory →
Red Hat 13 advisories
- RHSA-2026:20676 Released 2026-05-26 · Red Hat rating Importantpython-markdown security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-markdown-3.3.4-4.el9_6.2, python3-markdown-3.3.4-4.el9_6.2
- RHSA-2026:20674 Released 2026-05-26 · Red Hat rating Importantpython-markdown security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-markdown-3.3.4-4.el9_4.2, python3-markdown-3.3.4-4.el9_4.2
- RHSA-2026:20677 Released 2026-05-26 · Red Hat rating Importantpython-markdown security update
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-markdown-3.5.1-6.el10_0.1, python3-markdown-3.5.1-6.el10_0.1
Show 10 more Red Hat advisories
- RHSA-2026:19366 Released 2026-05-19 · Red Hat rating Importantpython-markdown security update
- Red Hat Enterprise Linux BaseOS (v. 9) python-markdown-3.3.4-4.el9_8.2, python3-markdown-3.3.4-4.el9_8.2
- RHSA-2026:19155 Released 2026-05-19 · Red Hat rating Importantpython-markdown security update
- Red Hat Enterprise Linux BaseOS (v. 10) python-markdown-3.5.1-6.el10_2.1, python3-markdown-3.5.1-6.el10_2.1
- RHSA-2026:14874 Released 2026-05-07 · Red Hat rating ImportantSatellite 6.16.8 Async Update
- Red Hat Satellite 6.16 for RHEL 8 candlepin-4.4.25-1.el8sat, candlepin-selinux-4.4.25-1.el8sat, python-markdown-3.8.2-1.el8pc +6
- Red Hat Satellite 6.16 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
- RHSA-2026:14873 Released 2026-05-07 · Red Hat rating ImportantSatellite 6.17.8 Async Update
- Red Hat Satellite 6.17 for RHEL 9 candlepin-4.4.25-1.el9sat, candlepin-selinux-4.4.25-1.el9sat, python-markdown-3.8.2-1.el9pc +6
- RHSA-2026:14835 Released 2026-05-07 · Red Hat rating ImportantSatellite 6.18.5 Async Update
- Red Hat Satellite 6.18 for RHEL 9 python3.12-django-4.2.30-1.el9pc, python3.12-markdown-3.8.2-1.el9pc, python3.12-pyOpenSSL-26.0.0-2.el9pc +1
- RHSA-2026:13826 Released 2026-05-05 · Red Hat rating CriticalRed Hat Developer Hub 1.9.4 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:13512 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
- RHSA-2026:13508 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:9742 Released 2026-04-22 · Red Hat rating CriticalRed Hat Developer Hub 1.8.6 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:13508 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:9742 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:13826 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:19155 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:19366 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:20677 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2026:20674 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.6) | Fixed | RHSA-2026:20676 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:14874 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:14874 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:14873 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:14835 |
Not affected: 20 products
- External Secrets Operator for Red Hat OpenShift
- Multicluster Engine for Kubernetes
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat Satellite 6
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-69534
- 2026-10-03 Alias added: GHSA-5wmx-573v-2qwq
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
Advisory 2
Sources
- CVE-2025-69534 · CVE Program
- CVE-2025-69534 · NVD
- FIRST EPSS
- GHSA-5wmx-573v-2qwq · GitHub Advisory Database · CC BY 4.0
- CVE-2025-69534 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences