Skip to main content

N A CVE-2026-4539

| EUVDEUVD-2026-14287 LOW
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-03-22 VulDB GHSA-5239-wwwm-4pmq
Denial Of Service N A Pygments
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
1.7 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
3.3 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

9
Severity Changed
Apr 29, 2026 - 01:11 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:11 NVD
4.8 (MEDIUM) 1.9 (LOW)
Severity Changed
Apr 24, 2026 - 16:37 NVD
LOW MEDIUM
CVSS changed
Apr 24, 2026 - 16:37 NVD
3.3 (LOW) 4.8 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Mar 23, 2026 - 14:31 vuln.today
Public exploit code
EUVD ID Assigned
Mar 22, 2026 - 06:00 euvd
EUVD-2026-14287
Analysis Generated
Mar 22, 2026 - 06:00 vuln.today
CVE Published
Mar 22, 2026 - 05:35 nvd
LOW 3.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 182 pypi packages depend on pygments (108 direct, 74 indirect)

Ecosystem-wide dependent count for version 2.20.0.

DescriptionCVE.org

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

A regular expression denial-of-service (ReDoS) vulnerability exists in Pygments up to version 2.19.2, specifically in the AdlLexer component within pygments/lexers/archetype.py. An attacker with local access can craft malicious input that triggers inefficient regex pattern matching, causing high CPU consumption and service degradation. A public proof-of-concept exploit is available, though the vulnerability requires local access and low privileges to exploit, resulting in a CVSS score of 3.3 with Proof-of-Concept availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P).

Technical ContextAI

Pygments is a widely-used syntax highlighter library for Python applications. The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the AdlLexer regex pattern in pygments/lexers/archetype.py suffers from catastrophic backtracking when processing specially-crafted input. This affects all Pygments versions up to 2.19.2 as indicated by CPE cpe:2.3:a:n/a:pygments:*:*:*:*:*:*:*:* (all versions prior to patching). The archetype lexer, used for parsing ADL (Archetype Definition Language) syntax, fails to properly constrain regex quantifiers, allowing an attacker to provide input that causes exponential time complexity in the regex matching engine.

RemediationAI

The primary remediation is to upgrade Pygments to a version newer than 2.19.2 once a patch is released by the project maintainers. Users should monitor the official Pygments repository (https://github.com/pygments/pygments/) and PyPI for security updates. Until a patched version is available, organizations can mitigate risk by restricting local access to systems running Pygments, disabling or removing the archetype lexer if not required (by modifying lexer registration in Pygments configuration), or implementing input validation and size limits on content passed to syntax highlighting functions. For applications using Pygments in CI/CD or batch processing, implement timeout mechanisms on lexer execution to prevent process hangs from malicious input. Consider running Pygments in isolated sandbox environments with resource quotas if processing untrusted files.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5
CVE-2015-8315 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

pygments
Release Status Fixed Version Urgency
bullseye vulnerable 2.7.1+dfsg-2.1 -
bookworm vulnerable 2.14.0+dfsg-1 -
trixie vulnerable 2.18.0+dfsg-2 -
forky, sid vulnerable 2.19.2+dfsg-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Low
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-4539 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy