Log in Start free

Vulnerability · Published Mar 22, 2026 · Assigned by VulDB

CVE-2026-4539pygments archetype.py AdlLexer redos

Low 3.3

In plain English

A low-severity regular-expression denial of service in pygments. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pygmentsno fix listedDEBIAN-CVE-2026-4539
Debian:13pygmentsno fix listedDEBIAN-CVE-2026-4539
Debian:14pygments2.20.0+dfsg-1DEBIAN-CVE-2026-4539
PyPIpygments2.20.0GHSA-5239-wwwm-4pmq
PyPIpygments2.20.0PYSEC-2026-2987
Ubuntu:22.04:LTSpygmentsno fix listedUBUNTU-CVE-2026-4539
Ubuntu:24.04:LTSpygmentsno fix listedUBUNTU-CVE-2026-4539
Ubuntu:25.10pygmentsno fix listedUBUNTU-CVE-2026-4539
Ubuntu:26.04:LTSpygmentsno fix listedUBUNTU-CVE-2026-4539
Ubuntu:26.10pygmentsno fix listedUBUNTU-CVE-2026-4539

Affected products (as reported)

VendorProductVersions
n/a pygments 2.19.02.19.12.19.2

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References