matthewwithanm/python-markdownify · Security
markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption
- GHSA ID
- GHSA-7mpr-5m44-h73r
- CVE ID
- CVE-2025-46656
- Severity
- low
- Published
- Updated
- CVSS
- 2.9 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 2.9 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as in addition to through . This causes memory consumption.
CWEs
- CWE-1284 · Improper Validation of Specified Quantity in Input
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-46656 ↗
- https://github.com/matthewwithanm/python-markdownify/issues/143 ↗
- https://github.com/matthewwithanm/python-markdownify/compare/0.14.0...0.14.1 ↗
- https://github.com/matthewwithanm/python-markdownify/commit/959561879693bf4a576f99c6733b50b01186aa08 ↗
- https://github.com/advisories/GHSA-7mpr-5m44-h73r ↗