PT-2026-26970 · Pygments · Pygments

Ybdesire · CVE-2026-4539 · Publicado 2026-03-22 · Atualizado 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions pygments versions up to 2.19.2

Description A security flaw exists in pygments. The issue resides within the AdlLexer function located in the pygments/lexers/archetype.py file, leading to inefficient regular expression complexity. This manipulation is only exploitable with local access. The exploit has been publicly released. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 2.19.2 should be updated. As a temporary workaround, consider restricting access to the AdlLexer function until a patch is available.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-1333

CWE-400

Identificadores relacionados

CLEANSTART-2026-AZ09261

CLEANSTART-2026-BY15343

CLEANSTART-2026-CQ05396

CLEANSTART-2026-EM82280

CLEANSTART-2026-FT24360

CLEANSTART-2026-FU68971

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-JU43269

CLEANSTART-2026-LJ72726

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-SO50412

CLEANSTART-2026-UO85049

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-4539

ECHO-C58F-806E-AB85

GHSA-5239-WWWM-4PMQ

MGASA-2026-0090

OESA-2026-1873

OPENSUSE-SU-2026:10476-1

OPENSUSE-SU-2026:20931-1

PYSEC-2026-2987

SUSE-SU-2026:1666-1

SUSE-SU-2026:1667-1

SUSE-SU-2026:22058-1

SUSE-SU-2026:22093-1

Produtos afetados

Pygments

Referências · 265

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4539.json · Exploit
• 🔥 https://github.com/pygments/pygments/issues/3058 · Exploit
• https://github.com/pygments/pygments/releases/tag/2.20.0 · Nota
• https://github.com/pygments/pygments · Nota
• https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc · Nota
• https://github.com/pygments/pygments/pull/3064 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BY15343.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HP19968.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WU03167.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EM82280.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FU68971.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IR98353.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SO50412.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NL78203.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JU43269.json · Nota