CVE-2021-27291: High severity Pygments Pygments vulnerability
A denial of service attack was discovered against pygments. Some of the regular expressions used to tokenise source code for highlighting have exponential complexity. A specially crafted input file could cause pygments to take effectively infinite time to parse, consuming CPU resources and denying access to the service.
Other sources
In pygments 1.1+ fixed in 2.7.4 the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input an attacker can cause a denial of service.
— Microsoft
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-27291.
What is the severity of CVE-2021-27291?
CVE-2021-27291 has a severity value of 7, which is considered high.
What is the description of CVE-2021-27291?
CVE-2021-27291 is a denial of service attack against pygments where specially crafted input files can cause the software to take infinite time to parse, consuming CPU resources.
How do I fix CVE-2021-27291?
To fix CVE-2021-27291, update your pygments package to version 2.7.4.
Where can I find more information about CVE-2021-27291?
You can find more information about CVE-2021-27291 in the references provided: https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce, https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14, https://lists.debian.org/debian-lts-announce/2021/03/msg00024.html