PT-2026-26970 · Pygments · Pygments

Ybdesire · CVE-2026-4539 · Published 2026-03-22 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions pygments versions up to 2.19.2

Description A security flaw exists in pygments. The issue resides within the AdlLexer function located in the pygments/lexers/archetype.py file, leading to inefficient regular expression complexity. This manipulation is only exploitable with local access. The exploit has been publicly released. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 2.19.2 should be updated. As a temporary workaround, consider restricting access to the AdlLexer function until a patch is available.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CLEANSTART-2026-AZ09261

CLEANSTART-2026-BY15343

CLEANSTART-2026-CQ05396

CLEANSTART-2026-EM82280

CLEANSTART-2026-FT24360

CLEANSTART-2026-FU68971

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-JU43269

CLEANSTART-2026-LJ72726

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-SO50412

CLEANSTART-2026-UO85049

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-4539

ECHO-C58F-806E-AB85

GHSA-5239-WWWM-4PMQ

MGASA-2026-0090

OESA-2026-1873

OPENSUSE-SU-2026:10476-1

OPENSUSE-SU-2026:20931-1

PYSEC-2026-2987

SUSE-SU-2026:1666-1

SUSE-SU-2026:1667-1

SUSE-SU-2026:22058-1

SUSE-SU-2026:22093-1

Affected Products

Pygments

References · 265

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4539.json · Exploit
• 🔥 https://github.com/pygments/pygments/issues/3058 · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NL78203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EM82280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://advisories.mageia.org/MGASA-2026-0090.html · Security Note
• https://cve.org/CVERecord?id=CVE-2026-4539 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22093-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note