CVE-2026-4539 Details
Description
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Pygments versions prior to 2.19.2. The issue is located in the AdlLexer within the file pygments/lexers/archetype.py. The vulnerability arises from a regular expression designed to match GUIDs, which contains nested repeating quantifiers. This flaw allows for catastrophic backtracking, causing significant performance degradation by exhausting CPU resources. The vulnerability can block the application thread indefinitely when processing large, maliciously crafted input.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 22, 2026CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pygments/pygments/ | [email protected] | Source CodeVendor |
| https://github.com/pygments/pygments/issues/3058 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.352327 | [email protected] | Content Wall |
| https://vuldb.com/?id.352327 | [email protected] | AdvisoryExploit |
| https://vuldb.com/?submit.774685 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pygments | <= 2.19.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 22, 2026 | New CVE Received | [email protected] |