low2.9
CVE-2025-46656
markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption
Impact
python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | markdownify | < 0.14.1 | 0.14.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Matthewwithanm | Markdownify | before 0.14.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/matthewwithanm/python-markdownify/compare/0.14.0...0.14.1
- https://github.com/matthewwithanm/python-markdownify/issues/143
- https://github.com/advisories/GHSA-7mpr-5m44-h73r
- https://nvd.nist.gov/vuln/detail/CVE-2025-46656
- https://github.com/matthewwithanm/python-markdownify/commit/959561879693bf4a576f99c6733b50b01186aa08