CVE-2025-69534High· 7.5▾ TwilightPython-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.7%
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
markdown = 3.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
markdown < 3.8.1Patched in:
markdown 3.8.1Source: https://osv.dev/vulnerability/GHSA-5wmx-573v-2qwq
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102941High· 7.5gomarkdown/markdown IsSafeURL panics on short URLs
CVE-2019-25781High· 7.5Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
CVE-2025-67726High· 7.5Tornado is a Python web framework and asynchronous networking library
CVE-2025-67725High· 7.5Tornado is a Python web framework and asynchronous networking library
CVE-2025-6176High· 7.5Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)
CVE-2022-23524High· 7.5helm: Denial of service through string value parsing (CVE-2022-23524)