PT-2026-26970 · Pygments · Pygments

Ybdesire · Publicado 2026-03-22 · Atualizado 2026-06-09 · CVE-2026-4539

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions pygments versions up to 2.19.2

Description A security flaw exists in pygments. The issue resides within the AdlLexer function located in the pygments/lexers/archetype.py file, leading to inefficient regular expression complexity. This manipulation is only exploitable with local access. The exploit has been publicly released. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 2.19.2 should be updated. As a temporary workaround, consider restricting access to the AdlLexer function until a patch is available.

Exploit

Correção

Resource Exhaustion

DoS

Enumeração de Fraquezas

CWE-400

CWE-1333

Identificadores relacionados

CVE-2026-4539

GHSA-5239-WWWM-4PMQ

MGASA-2026-0090

OESA-2026-1873

OPENSUSE-SU-2026:10476-1

OPENSUSE-SU-2026:20931-1

SUSE-SU-2026:22058-1

SUSE-SU-2026:22093-1

Produtos afetados

Pygments

Referências · 33

• 🔥 https://github.com/pygments/pygments/issues/3058 · Exploit
• https://github.com/pygments/pygments/releases/tag/2.20.0 · Nota
• https://github.com/pygments/pygments/pull/3064 · Nota
• https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc · Nota
• https://github.com/pygments/pygments · Nota
• https://suse.com/support/update/announcement/2026/suse-su-202622093-1 · Nota
• https://vuldb.com/?id.352327 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-4539 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=35318 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:22093-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-4539 · Aviso do Fabricante
• https://bugzilla.suse.com/1260796 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:10476-1 · Aviso do Fabricante
• https://vuldb.com/?submit.774685 · Nota
• https://suse.com/security/cve/CVE-2026-4539 · Nota