CVE-2025-69534: Python-Markdown Uncaught Exception Leading to Denial of Service
Summary
CVE-2025-69534: Python-Markdown has an Uncaught Exception. Affects markdown versions < 3.8.1. Fixed in 3.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Markdown is a widely used library for converting Markdown text to HTML. It is known for its simplicity and flexibility, allowing developers to easily integrate Markdown parsing into their applications. However, the library is vulnerable to specific malformed HTML-like sequences that can cause the parser to crash, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability in Python-Markdown version 3.8 arises from the failure to handle malformed HTML-like sequences during Markdown parsing. When such sequences are encountered, the html.parser.HTMLParser raises an unhandled AssertionError. This lack of exception handling means that any application processing untrusted Markdown can crash, resulting in remote, unauthenticated Denial of Service. This issue can affect web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The vulnerability has been acknowledged by the vendor and was fixed in version 3.8.1.
How To Fix
Latest published version: 3.11.2 as of 22 Oct 2026
pip install --upgrade "markdown==3.11.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.1
This is the first release that contains the fix.
pip install --upgrade "markdown==3.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider implementing input validation to sanitize Markdown content before processing it. This can help prevent malformed sequences from being parsed. Additionally, you can catch exceptions in your application code to handle potential crashes gracefully.
Conclusion
The vulnerability identified as CVE-2025-69534 in Python-Markdown poses a significant risk of Denial of Service due to unhandled exceptions during Markdown parsing. It is crucial for developers using this library to update to version 3.8.1 or later to ensure their applications remain secure.
See every vulnerability recorded for markdown →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Python-Markdown versions prior to 3.8.1 are affected by this vulnerability.
The vulnerability can lead to Denial of Service, causing applications to crash when processing untrusted Markdown.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement input validation and exception handling in your application to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for markdown.
