Skip to main content

Pygments EUVDEUVD-2026-14287

| CVE-2026-4539 LOW
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-03-22 VulDB GHSA-5239-wwwm-4pmq
Denial Of Service N A Pygments
1.9
CVSS 4.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-1333
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

While the CVSS score of 3.3 is low, the risk assessment must consider multiple factors: the attack vector is local with low privilege requirements (AV:L/AC:L/PR:L), indicating this is not an easily exploitable remote vulnerability in typical deployments. However, the exploit-proof-of-concept (E:P) and public availability elevates practical risk for systems where Pygments processes untrusted local input. The impact is availability-only (A:L) with no confidentiality or integrity compromise, meaning this causes denial-of-service rather than data breach. For applications that expose Pygments functionality to local users or batch-process untrusted files (e.g., CI/CD pipelines, document rendering services), this becomes a moderate concern. The project's lack of response post-disclosure and unpatched status increase risk. Overall, this is a low-to-moderate priority vulnerability suitable for standard patching cycles, not emergency response, unless the system explicitly processes untrusted local content through the archetype lexer.
Exploit ScenarioDerived

A local user with legitimate system access submits a specially-crafted archetype file (containing malformed ADL syntax designed to trigger ReDoS) to a documentation generation system or code analysis tool that uses Pygments. The AdlLexer attempts to parse the file, and the inefficient regex matching causes the process to consume 100% CPU for extended periods, starving other system processes and causing service degradation or timeout. The public proof-of-concept exploit (available on GitHub) makes this scenario reproducible for any attacker with local access to a system running vulnerable Pygments versions.
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 22, 2026

A regular expression denial-of-service (ReDoS) vulnerability exists in Pygments up to version 2.19.2, specifically in the AdlLexer component within pygments/lexers/archetype.py. An attacker with local access can craft malicious input that triggers inefficient regex pattern matching, causing high CPU consumption and service degradation. A public proof-of-concept exploit is available, though the vulnerability requires local access and low privileges to exploit, resulting in a CVSS score of 3.3 with Proof-of-Concept availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P).

RemediationAI

The primary remediation is to upgrade Pygments to a version newer than 2.19.2 once a patch is released by the project maintainers. Users should monitor the official Pygments repository (https://github.com/pygments/pygments/) and PyPI for security updates. Until a patched version is available, organizations can mitigate risk by restricting local access to systems running Pygments, disabling or removing the archetype lexer if not required (by modifying lexer registration in Pygments configuration), or implementing input validation and size limits on content passed to syntax highlighting functions. For applications using Pygments in CI/CD or batch processing, implement timeout mechanisms on lexer execution to prevent process hangs from malicious input. Consider running Pygments in isolated sandbox environments with resource quotas if processing untrusted files.

Affected VersionsENISA

pygments 2.19.0
pygments 2.19.2
pygments 2.19.1

Affected Packages

pypi pygments fix: 2.20.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Pygments is a widely-used syntax highlighter library for Python applications. The vulnerability is rooted in CWE-1333 (Inefficient Regular Expression Complexity), where the AdlLexer regex pattern in pygments/lexers/archetype.py suffers from catastrophic backtracking when processing specially-crafted input. This affects all Pygments versions up to 2.19.2 as indicated by CPE cpe:2.3:a:n/a:pygments:*:*:*:*:*:*:*:* (all versions prior to patching). The archetype lexer, used for parsing ADL (Archetype Definition Language) syntax, fails to properly constrain regex quantifiers, allowing an attacker to provide input that causes exponential time complexity in the regex matching engine.

Know when Pygments gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
SUSE 1.7 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat 3.3 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

7
Severity Changed
Apr 29, 2026 - 01:11 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:11 NVD
4.8 (MEDIUM) 1.9 (LOW)
Severity Changed
Apr 24, 2026 - 16:37 NVD
LOW MEDIUM
CVSS changed
Apr 24, 2026 - 16:37 NVD
3.3 (LOW) 4.8 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Mar 23, 2026 - 14:31 vuln.today
Public exploit code
CVE Published
Mar 22, 2026 - 05:35 nvd
LOW 3.3

DescriptionCVE.org

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive ViewAI

Why It Matters

CVE-2026-4539 is a low-severity vulnerability in pygments (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low
Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +10
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Pygments

View all
CVE-2021-27291 HIGH POC
7.5 Mar 17

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Ra
CVE-2015-8557 CRITICAL
9.0 Jan 08

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers
CVE-2021-20270 HIGH
7.5 Mar 23

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax high

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-116693 HIGH POC
8.7
CVE-2026-48801 HIGH POC
8.7
CVE-2026-57584 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2026-118686 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

pygments
Release Status Fixed Version Urgency
bullseye vulnerable 2.7.1+dfsg-2.1 -
bookworm vulnerable 2.14.0+dfsg-1 -
trixie vulnerable 2.18.0+dfsg-2 -
forky, sid vulnerable 2.19.2+dfsg-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Low
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4539 ADVISORY https://vuldb.com/?id.352327 REF https://github.com/pygments/pygments/ REF https://vuldb.com/?ctiid.352327 REF https://vuldb.com/?id.352327 REF https://vuldb.com/?submit.774685

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy