CVE-2025-69534
highPriorität · verfolgen · 30EPSS 0.006 · 49. PerzentilCHDEEURUUSEPSS · bewertet 2026-10-27
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenpython311-Markdown-0:3.5.2-150600.3.3.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Kein Fix verfügbarLabX Standardmettler_toledo_psirt
This vulnerability will be fixed in the upcoming releases
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–8.2
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (32)
Betroffene Produkte und Versionsbereiche.
- Red Hat Ansible Automation Platform 2.5alle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:2.5
- Red Hat Ansible Automation Platform 2.6alle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- SUSE-SU-2026:0846-1Security update for python-Markdown2026-03-06csaf · suse_csafDE
Security update for python-Markdown
- VDE-2026-088METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.42026-08-20csaf · mettler_toledo_psirtCH
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
- WID-SEC-W-2026-1610Red Hat Enterprise Linux (JWCrypto und python-markdown): Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2026-05-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-5wmx-573v-2qwqPython-Markdown has an Uncaught Exception2026-03-05ghsa · osvUS
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
- PYSEC-2026-892026-03-05vendor · osvUS
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (26)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/Python-Markdown/markdowncnnvd
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892cnnvd
- https://github.com/Python-Markdown/markdown/issues/1534cnnvd
- https://github.com/Python-Markdown/markdownenisa_euvd
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892enisa_euvd
- https://github.com/Python-Markdown/markdown/issues/1534enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/03/06/4Mailing ListThird Party Advisorynvd
- https://access.redhat.com/errata/RHSA-2026:10184nvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan