CVE-2025-69534
Published: 05 March 2026
Summary
CVE-2025-69534 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Python-Markdown Markdown. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69534 is a vulnerability in Python-Markdown version 3.8, where malformed HTML-like sequences trigger an unhandled AssertionError in Python's html.parser.HTMLParser during Markdown parsing. Because Python-Markdown does not catch this exception, applications that process attacker-controlled Markdown are susceptible to crashes. This issue affects any software or service relying on Python-Markdown 3.8 for parsing untrusted input, including web applications, documentation systems, and CI/CD pipelines.
A remote, unauthenticated attacker can exploit this vulnerability by supplying specially crafted Markdown content, causing the parsing process to fail and resulting in denial of service through application crashes. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) highlights its ease of exploitation and high availability impact, with no privileges or user interaction required. The vulnerability is linked to CWE-400 (Uncontrolled Resource Consumption) and may also enable information disclosure via details in uncaught exceptions.
The vendor acknowledged the issue and addressed it in Python-Markdown version 3.8.1. Mitigation involves upgrading to the patched version. Additional details are documented in the project's GitHub repository at https://github.com/Python-Markdown/markdown, issue #1534 at https://github.com/Python-Markdown/markdown/issues/1534, a related CI action at https://github.com/Python-Markdown/markdown/actions/runs/15736122892, and an announcement on the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/03/06/4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208312
Vulnerability details
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated…
more
Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Crafted Markdown input triggers unhandled exception and crash in any app parsing untrusted content, directly enabling application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching of known flaws like CVE-2025-69534 by upgrading Python-Markdown to version 3.8.1, directly eliminating the unhandled AssertionError vulnerability.
Mandates graceful error handling to catch and manage exceptions from malformed HTML-like sequences in Markdown parsing, preventing application crashes and denial of service.
Requires validation of untrusted Markdown input to reject or sanitize malformed sequences before parsing, reducing the risk of triggering the HTMLParser AssertionError.