CVE-2025-69534 is a denial of service vulnerability in Python-Markdown versions before 3.8.1. Malformed HTML-like sequences trigger an unhandled AssertionError in html.parser.HTMLParser during Markdown parsing. Because Python-Markdown does not catch this exception, any application processing untrusted Markdown can crash remotely without authentication. The vendor acknowledged the issue and fixed it in version 3.8.1. Red Hat Enterprise Linux 9 and 10 packages for python-markdown prior to the updated versions 3.3.4-4.el9_8.2 and 3.5.1-6.el10_2.1 respectively are affected. The CVSS v3.1 base score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing applications that parse untrusted Markdown content. This can disrupt web applications, documentation systems, CI/CD pipelines, and other services relying on Python-Markdown. There is no direct confidentiality or integrity impact reported. No known exploits in the wild have been observed. The issue may also lead to information disclosure through uncaught exceptions, but this is not detailed further.

Red Hat has released security updates for python-markdown in Red Hat Enterprise Linux 9 and 10 that fix this vulnerability. Users should apply the updated packages (e.g., python-markdown-3.3.4-4.el9_8.2 for RHEL 9 and python-markdown-3.5.1-6.el10_2.1 for RHEL 10) as soon as possible. The vendor advisory confirms the fix is available and recommends updating to these patched versions. No additional mitigation is required once the update is applied.