Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
GHSA-5239-wwwm-4pmq · CVE-2026-4539 · PYSEC-2026-2987
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4539
- WEB https://github.com/pygments/pygments/issues/3058
- WEB https://github.com/pygments/pygments/pull/3064
- WEB https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc
- PACKAGE https://github.com/pygments/pygments
- WEB https://github.com/pygments/pygments/releases/tag/2.20.0
- WEB https://vuldb.com/?ctiid.352327
- WEB https://vuldb.com/?id.352327
- WEB https://vuldb.com/?submit.774685
Ready to move
Start Securing
Free, no credit card | First findings in minutes