Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19155 advisory.

    [3.5.1-6.1]
    - Fix CVE-2025-69534 (RHEL-153740)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1228:01 advisory.

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:19366 advisory.

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

    It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could     possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu     24.04 LTS. (CVE-2025-13462)

    It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker     could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

    It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could     possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-1299)

    It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed     characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to     inject arbitrary HTTP headers. (CVE-2026-1502)

    It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc     files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

    It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An     attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial     of service. (CVE-2026-3276)

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be     interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary     commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

    It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-4786)

    It was discovered that Python's remote debugging module did not properly validate offset tables when     loading debug information. An attacker could possibly use this issue to cause Python to crash or execute     arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free     vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary     code. (CVE-2026-6100)

    It was discovered that Python's tarfile module did not properly validate link targets when using the data     filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

    It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV     responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side     request forgery attacks. (CVE-2026-8328)

    It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression     error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
    (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19366 advisory.

    [3.3.4-4.2]
    - Fix CVE-2025-69534 (RHEL-153747)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:19155 advisory.

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:19366 advisory.

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:20674 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:20677 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:20676 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:19366 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:19155 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- markdown-3.3.4-5.el9 build changelog.

  - Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause     html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-     Markdown does not catch this exception, any application that processes attacker-controlled Markdown may     crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems,     CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor     and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing     untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions. (CVE-2025-69534)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14873 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image (CVE-2026-25990)

    * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects     (CVE-2026-27727)

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    * python-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)

    * rubygem-activesupport: Active Support: Denial of Service via large scientific notation strings     (CVE-2026-33176)

    Bug Fix(es):

    * Satellite manifest consumer profile cert and key found in satellite client rhsm cache (SAT-43920)

    * All communication should happen only over https during global registration execution (SAT-43921)

    * Impossible to generate registration command via REST API in isolated networks managed by external     capsules (SAT-43922)

    * Errata applicability and Refresh applicability tasks for RHEL 7 hosts runs dnf command. (SAT-43923)

    * BIOS info is not populated in All hosts page and in Host Details tab (SAT-43925)

    * Executing the 'katello::clean_backend_objects' rake task takes a long time to complete (SAT-43926)

    * Puppet fact parser can't create OS entry blocking Satellite leapp upgrades (SAT-43928)

    * No repositories available through subscriptions on a cloud-instance host after registering it to Red Hat     Satellite using global registration method (SAT-43929)

    * Proxy password shown in clear text in the Overview page of Virt-who Configuration (SAT-43931)

    * Non-admin users on Satellite with viewer role, unable to see the hostgroup. (SAT-44039)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14874 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image (CVE-2026-25990)

    * candlepin: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects     (CVE-2026-27727)

    * python-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)

    * python-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)

    * rubygem-activesupport: Active Support: Denial of Service via large scientific notation strings     (CVE-2026-33176)

    Bug Fix(es):

    * Satellite manifest consumer profile cert and key found in satellite client rhsm cache (SAT-43030)

    * All communication should happen only over https during global registration execution (SAT-44031)

    * Impossible to generate registration command via REST API in isolated networks managed by external     capsules (SAT-44032)

    * Executing the 'katello::clean_backend_objects' rake task takes a long time to complete (SAT-44033)

    * Puppet fact parser can't create OS entry blocking Satellite leapp upgrades (SAT-44035)

    * No repositories available through subscriptions on a cloud-instance host after registering it to Red Hat     Satellite using global registration method (SAT-44036)

    * Proxy password shown in clear text in the Overview page of Virt-who Configuration (SAT-43834)

    * Non-admin users on Satellite with viewer role, unable to see the hostgroup. (SAT-44034)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14835 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python3.12-django: Django: SQL Injection via crafted column aliases     (CVE-2026-1287)
    * python3.12-django: Django: SQL Injection via RasterField band index     parameter (CVE-2026-1207)
    * python3.12-django: Django: SQL injection via crafted column aliases in     QuerySet.order_by() (CVE-2026-1312)
    * python3.12-django: Django: Denial of Service via crafted HTML inputs     (CVE-2026-1285)
    * python3.12-django: Django: Denial of Service via crafted request with     duplicate headers (CVE-2025-14550)
    * python3.12-markdown: markdown: Denial of Service via malformed     HTML-like sequences (CVE-2025-69534)
    * python3.12-pyOpenSSL: pyOpenSSL: DTLS cookie callback buffer overflow     (CVE-2026-27459)
    * rubygem-activesupport: Active Support: Denial of Service via large     scientific notation strings (CVE-2026-33176)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13512 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-controller: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-gateway: SVGO: Denial of Service via XML entity expansion (CVE-2026-29074)
    * automation-gateway: ReDoS via $data reference (CVE-2025-69873)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13508 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * automation-platform-ui: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-platform-ui: minimatch: Denial of Service via specially crafted glob patterns     (CVE-2026-26996)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1492 advisory.

    Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause     html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-     Markdown does not catch this exception, any application that processes attacker-controlled Markdown may     crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems,     CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor     and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing     untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions. (CVE-2025-69534)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0846-1 advisory.

    This update for python-Markdown fixes the following issue:

    - CVE-2025-69534: incomplete markup declaration in raw HTML can crash applications that process untrusted     Markdown       (bsc#1259256).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause
    html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-
    Markdown does not catch this exception, any application that processes attacker-controlled Markdown may
    crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems,
    CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor
    and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing
    untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions. (CVE-2025-69534)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause     html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-     Markdown does not catch this exception, any application that processes attacker-controlled Markdown may     crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems,     CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor     and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing     untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions. (CVE-2025-69534)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328011	Oracle Linux 10 : python-markdown (ELSA-2026-19155)	Nessus	Oracle Linux Local Security Checks	medium
325964	MiracleLinux 9 : python-markdown-3.3.4-4.el9_8.2 (AXSA:2026-1228:01)	Nessus	Miracle Linux Local Security Checks	medium
325501	AlmaLinux 9 : python-markdown (ALSA-2026:19366)	Nessus	Alma Linux Local Security Checks	medium
325428	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)	Nessus	Ubuntu Local Security Checks	critical
322565	Oracle Linux 9 : python-markdown (ELSA-2026-19366)	Nessus	Oracle Linux Local Security Checks	medium
317969	RockyLinux 10 : python-markdown (RLSA-2026:19155)	Nessus	Rocky Linux Local Security Checks	medium
317410	RockyLinux 9 : python-markdown (RLSA-2026:19366)	Nessus	Rocky Linux Local Security Checks	medium
316878	RHEL 9 : python-markdown (RHSA-2026:20674)	Nessus	Red Hat Local Security Checks	medium
316817	RHEL 10 : python-markdown (RHSA-2026:20677)	Nessus	Red Hat Local Security Checks	medium
316744	RHEL 9 : python-markdown (RHSA-2026:20676)	Nessus	Red Hat Local Security Checks	medium
315483	RHEL 9 : python-markdown (RHSA-2026:19366)	Nessus	Red Hat Local Security Checks	medium
315410	RHEL 10 : python-markdown (RHSA-2026:19155)	Nessus	Red Hat Local Security Checks	medium
314434	CentOS 9 : python-markdown-3.3.4-5.el9	Nessus	CentOS Local Security Checks	medium
313174	RHEL 9 : Satellite 6.17.8 Async Update (Important) (RHSA-2026:14873)	Nessus	Red Hat Local Security Checks	critical
313105	RHEL 8 / 9 : Satellite 6.16.8 Async Update (Important) (RHSA-2026:14874)	Nessus	Red Hat Local Security Checks	critical
313104	RHEL 9 : Satellite 6.18.5 Async Update (Important) (RHSA-2026:14835)	Nessus	Red Hat Local Security Checks	critical
312098	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:13512)	Nessus	Red Hat Local Security Checks	critical
312090	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:13508)	Nessus	Red Hat Local Security Checks	critical
304292	Amazon Linux 2023 : python3-markdown (ALAS2023-2026-1492)	Nessus	Amazon Linux Local Security Checks	medium
301810	openSUSE 15 Security Update : python-Markdown (SUSE-SU-2026:0846-1)	Nessus	SuSE Local Security Checks	medium
438442	SCA: security update for Markdown (GHSA-5wmx-573v-2qwq)	Tenable Cloud Security	SCA Checks	medium
438442	SCA: security update for Markdown (GHSA-5wmx-573v-2qwq)	Tenable Self-Hosted Container Security	SCA Checks	medium
301189	Linux Distros Unpatched Vulnerability : CVE-2025-69534	Nessus	Misc.	high

Detections

Analytics

CVE-2025-69534

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

critical

critical

medium

medium

medium

medium

high