CVE-2025-46656 Details
Description
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.
A memory consumption vulnerability has been identified in python-markdownify (markdownify) versions prior to 0.14.1. The issue arises from the library's handling of excessively large headline prefixes, such as <h9999999>, in addition to the standard <h1> through <h6> tags. This flaw can lead to rapid resource exhaustion, causing machines to freeze due to 100% memory usage within seconds. The problem has been reproduced using the atheris library, and could potentially be exploited by feeding large headline tags into a server, according to the issue description on GitHub.
Users are advised to update python-markdownify to version 0.14.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| matthewwithanm markdownify | < 0.14.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Apr 29, 2025 | CVE Modified | CISA-ADP |
| Apr 26, 2025 | New CVE Received | [email protected] |