CVE-2021-20270: High severity Pygments Pygments vulnerability
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Other sources
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file as demonstrated by input that only contains the "exception" keyword.
— Microsoft
Infinite loop in SML lexer may lead to DoS. When the SMLLexer gets fed the string "exception" it seems to loop indefinitely.
Upstream Fix:
https://github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-20270.
What is the severity level of CVE-2021-20270?
The severity level of CVE-2021-20270 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2021-20270?
Pygments versions 1.5 to 2.7.3 are affected by CVE-2021-20270.
How can I fix the vulnerability in Pygments?
To fix the vulnerability, update Pygments to version 2.7.4.
Where can I find more information about CVE-2021-20270?
More information about CVE-2021-20270 can be found at the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi?id=1922136), [Reference 2](https://www.debian.org/security/2021/dsa-4889), [Reference 3](https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html).