CVE-2026-4539: pygments archetype.py AdlLexer redos
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4539?
CVE-2026-4539 has a severity rating that indicates it can lead to performance degradation due to inefficient regular expression processing.
How do I fix CVE-2026-4539?
To fix CVE-2026-4539, upgrade pygments to a version higher than 2.19.2 that does not contain this vulnerability.
What is the impact of CVE-2026-4539?
The impact of CVE-2026-4539 is that it allows for denial of service attacks through excessive resource consumption when using the AdlLexer function.
Which versions of pygments are affected by CVE-2026-4539?
Pygments versions up to and including 2.19.2 are affected by CVE-2026-4539.
Is there a workarounds for CVE-2026-4539?
While the best practice is to upgrade, a temporary workaround is to avoid using the AdlLexer for applications where regex performance is critical.