CVE-2025-46656

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-26 · updated 2026-06-17
Weakness: CWE-1284

Description

python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.

Affected products

python-markdownify: before 0.14.1 — fixed in 0.14.1

How to fix

Upgrade to a fixed version: python-markdownify 0.14.1. Check the vendor advisory for mitigations.

References

https://github.com/matthewwithanm/python-markdownify/compare/0.14.0...0.14.1
https://github.com/matthewwithanm/python-markdownify/issues/143
https://github.com/matthewwithanm/python-markdownify/issues/143

Get alerted when CVE-2025-46656 or the next vulnerability affects your stack